Windows Analysis Report
Facturas.exe

Overview

General Information

Sample name: Facturas.exe
Analysis ID: 1541874
MD5: af60907e3d43618d4db0730aef26e7dd
SHA1: 8afc3704d1053147ef397913ee55125d7b5f5c27
SHA256: 445b43c35311fcebb9f753c4572ba882d23cb73be51128f8fbb21c3af60db51e
Tags: exeuser-lowmal3
Infos:

Detection

DarkCloud
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected Generic Dropper
.NET source code contains potential unpacker
AI detected suspicious sample
Drops VBS files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes or reads registry keys via WMI
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May check the online IP address of the machine
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
DarkCloud Stealer Stealer is written in Visual Basic. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Facturas.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Id.exe Avira: detection malicious, Label: HEUR/AGEN.1310705
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Id.exe ReversingLabs: Detection: 63%
Multi AV Scanner detection for submitted file
Source: Facturas.exe ReversingLabs: Detection: 63%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Id.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Facturas.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Cookies
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \Default\Login Data
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \Login Data
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Password :
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: //setting[@name='Password']/value
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: SMTP Email Address
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: NNTP Email Address
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Email
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: HTTPMail User Name
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: HTTPMail Server
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^3[47][0-9]{13}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(6541|6556)[0-9]{12}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^389[0-9]{11}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^63[7-9][0-9]{13}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(?:2131|1800|35\\d{3})\\d{11}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^9[0-9]{15}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(6304|6706|6709|6771)[0-9]{12,15}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Mastercard
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(62[0-9]{14,17})$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Visa Card
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Visa Master Card
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \logins.json
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \signons.sqlite
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Foxmail.exe
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: mail\
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \Accounts\Account.rec0
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \AccCfg\Accounts.tdat
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: EnableSignature
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: Application : FoxMail
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: encryptedUsername
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: logins
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: encryptedPassword
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/sendusing
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/smtpauthenticate
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: mail.baleromex.com
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/smtpserver
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/smtpserverport
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/smtpusessl
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/sendusername
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: http://schemas.microsoft.com/cdo/configuration/sendpassword
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \Default\Cookies
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \Cookies
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \cookies.sqlite
Source: 13.2.Id.exe.3ff6f40.2.unpack String decryptor: \cookies.db
Uses 32bit PE files
Source: Facturas.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Facturas.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1261777030.0000000005C80000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: W.pdb4 source: Facturas.exe, 00000000.00000002.1248872319.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002F78000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2479512482.000000000043F000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1261777030.0000000005C80000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.55.60.2 162.55.60.2
May check the online IP address of the machine
Source: unknown DNS query: name: showip.net
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49699 -> 162.55.60.2:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49791 -> 162.55.60.2:80
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_00435A20 InternetOpenA,InternetOpenUrlA,InternetReadFile, 14_2_00435A20
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1Host: showip.net
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1Host: showip.net
Source: global traffic DNS traffic detected: DNS query: showip.net
Source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1248872319.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/R
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/Z
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/e1
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.net/g
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.netdD
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.nets
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://showip.netth?
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Facturas.exe, 00000000.00000002.1248872319.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002B21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Writes or reads registry keys via WMI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Detected potential crypto function
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_02D8B740 0_2_02D8B740
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_02D8BDD0 0_2_02D8BDD0
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_0657EBA0 0_2_0657EBA0
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_06560040 0_2_06560040
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_06560006 0_2_06560006
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_0657DF00 0_2_0657DF00
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_00E1B740 13_2_00E1B740
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_00E1BDD0 13_2_00E1BDD0
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_05FFEBA0 13_2_05FFEBA0
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_05FE0040 13_2_05FE0040
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_05FE0007 13_2_05FE0007
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_05FFDF00 13_2_05FFDF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_00402BFE 14_2_00402BFE
Sample file is different than original file name gathered from version info
Source: Facturas.exe, 00000000.00000002.1256345226.0000000003F06000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBvtxvylvl.dll" vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1247563242.0000000000F3E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefitchering.exe vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1261777030.0000000005C80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1248872319.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefitchering.exe vs Facturas.exe
Source: Facturas.exe, 00000000.00000002.1259081676.0000000005770000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameBvtxvylvl.dll" vs Facturas.exe
Source: Facturas.exe Binary or memory string: OriginalFilenameAxotmchmc.exe4 vs Facturas.exe
Uses 32bit PE files
Source: Facturas.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Facturas.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Id.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Facturas.exe, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Facturas.exe, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Facturas.exe, -.cs Cryptographic APIs: 'CreateDecryptor'
Source: Id.exe.0.dr, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Id.exe.0.dr, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Id.exe.0.dr, -.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: InstallUtil.exe, 00000002.00000002.2479468406.0000000000440000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2479512482.000000000043F000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: |C@*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp um
Source: Facturas.exe, 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2479512482.0000000000401000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: D63@D*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbpx<@8
Source: InstallUtil.exe Binary or memory string: D*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@8/45@1/1
Source: C:\Users\user\Desktop\Facturas.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: NULL
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs"
Source: Facturas.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Facturas.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: InstallUtil.exe Binary or memory string: SELECT item1 FROM metadata WHERE id = 'password';
Source: LogabacusPqxXfnFffmMmEflyaway.2.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Facturas.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\Desktop\Facturas.exe File read: C:\Users\user\Desktop\Facturas.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Facturas.exe "C:\Users\user\Desktop\Facturas.exe"
Source: C:\Users\user\Desktop\Facturas.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\Id.exe "C:\Users\user\AppData\Roaming\Id.exe"
Source: C:\Users\user\AppData\Roaming\Id.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Facturas.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\Id.exe "C:\Users\user\AppData\Roaming\Id.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msvbvm60.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vb6zz.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cdosys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: inetcomm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: inetres.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msvbvm60.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vb6zz.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cdosys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: inetcomm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msoert2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: inetres.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Facturas.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Facturas.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: Facturas.exe Static file information: File size 1189888 > 1048576
Source: Facturas.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x121e00
Source: Facturas.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1261777030.0000000005C80000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: W.pdb4 source: Facturas.exe, 00000000.00000002.1248872319.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002F78000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2479512482.000000000043F000.00000040.00000400.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Facturas.exe, 00000000.00000002.1248872319.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Facturas.exe, 00000000.00000002.1261777030.0000000005C80000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Facturas.exe, 00000000.00000002.1260747588.0000000005B10000.00000004.08000000.00040000.00000000.sdmp, Id.exe, 0000000D.00000002.1411737595.0000000003B45000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Facturas.exe, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: Facturas.exe, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: Id.exe.0.dr, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: Id.exe.0.dr, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Facturas.exe.5b10000.6.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 0.2.Facturas.exe.5b10000.6.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 0.2.Facturas.exe.5b10000.6.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 0.2.Facturas.exe.5b10000.6.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 0.2.Facturas.exe.5b10000.6.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 0.2.Facturas.exe.5c80000.8.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 13.2.Id.exe.3cfd560.3.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Yara detected Costura Assembly Loader
Source: Yara match File source: 0.2.Facturas.exe.5b70000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Id.exe.3e666f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1260940324.0000000005B70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1248872319.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1411737595.0000000003DD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1393116166.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Facturas.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Id.exe PID: 7412, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_02D807B0 push esp; retf 0_2_02D807B1
Source: C:\Users\user\Desktop\Facturas.exe Code function: 0_2_06567B38 push dword ptr [ebp-17000000h]; retf 0_2_06567B3E
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_00E107B0 push esp; retf 13_2_00E107B1
Source: C:\Users\user\AppData\Roaming\Id.exe Code function: 13_2_05FE7B38 push dword ptr [ebp-17000000h]; retf 13_2_05FE7B3E
Source: Facturas.exe Static PE information: section name: .text entropy: 7.991574593264377
Source: Id.exe.0.dr Static PE information: section name: .text entropy: 7.991574593264377
Drops PE files
Source: C:\Users\user\Desktop\Facturas.exe File created: C:\Users\user\AppData\Roaming\Id.exe Jump to dropped file

Boot Survival
barindex
Drops VBS files to the startup folder
Source: C:\Users\user\Desktop\Facturas.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\Facturas.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\Facturas.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Id.vbs Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Facturas.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Id.exe PID: 7412, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Facturas.exe, 00000000.00000002.1248872319.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, Id.exe, 0000000D.00000002.1393116166.0000000002B21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Facturas.exe Memory allocated: 1490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Memory allocated: 2DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Memory allocated: 4DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Memory allocated: E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Memory allocated: 2B20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Memory allocated: 1020000 memory reserve | memory write watch Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: foregroundWindowGot 1652 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: foregroundWindowGot 1773 Jump to behavior
Source: WebData.2.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: WebData.2.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: WebData.2.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: WebData.2.dr Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: WebData.2.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: WebData.2.dr Binary or memory string: outlook.office.comVMware20,11696492231s
Source: WebData.2.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: WebData.2.dr Binary or memory string: AMC password management pageVMware20,11696492231
Source: WebData.2.dr Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: WebData.2.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: wscript.exe, 0000000C.00000002.1381728463.000001FA3E194000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: WebData.2.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: WebData.2.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: WebData.2.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: WebData.2.dr Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW$M
Source: WebData.2.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: WebData.2.dr Binary or memory string: discord.comVMware20,11696492231f
Source: WebData.2.dr Binary or memory string: global block list test formVMware20,11696492231
Source: WebData.2.dr Binary or memory string: dev.azure.comVMware20,11696492231j
Source: WebData.2.dr Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: WebData.2.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: WebData.2.dr Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: WebData.2.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: WebData.2.dr Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Id.exe, 0000000D.00000002.1393116166.0000000002B21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
Source: WebData.2.dr Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Id.exe, 0000000D.00000002.1393116166.0000000002B21000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: model0Microsoft|VMWare|Virtual
Source: wscript.exe, 0000000C.00000002.1381728463.000001FA3E194000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yE
Source: WebData.2.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: WebData.2.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: WebData.2.dr Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: WebData.2.dr Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: WebData.2.dr Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: WebData.2.dr Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: WebData.2.dr Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: C:\Users\user\Desktop\Facturas.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Facturas.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Facturas.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\Id.exe "C:\Users\user\AppData\Roaming\Id.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:17]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:18]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatadMAuPpXP.txt.2.dr, KeyDatarxjoXUur.txt.2.dr Binary or memory string: [03:13:50]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, KeyDatalMReqyDc.txt.2.dr, KeyDataMwoscjvf.txt.2.dr Binary or memory string: [03:13:39]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:05]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, KeyDatalMReqyDc.txt.2.dr Binary or memory string: [03:13:40]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.000000000122A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:27]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:41]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :03]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:07]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:53]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.000000000122A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.000000000121A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:29]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [3:13:57]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:55]<<Program Manager>>>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:06]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:28]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:59]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manageroard Managerg
Source: KeyDatalpqVYngJ.txt.2.dr Binary or memory string: [03:13:37]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 03:14:00]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:43]<<Program ManageriesesFC
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:15]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:31]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:03]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :17]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:38]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:55]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:48]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerex.com"-
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:13:55]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:21]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:15]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:20]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:48]<<Program Manager>>JJt
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataGBsLLrRN.txt.2.dr, KeyDataSojrcmUK.txt.2.dr Binary or memory string: [03:13:47]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:57]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 5]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataSojrcmUK.txt.2.dr, KeyDatarxjoXUur.txt.2.dr Binary or memory string: [03:13:49]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:13]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:22]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:11]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.000000000121A000.00000004.00000020.00020000.00000000.sdmp, KeyDataXHmOQNcn.txt.2.dr, KeyDatasTLASBBX.txt.2.dr Binary or memory string: [03:13:30]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:13]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:35]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04]<<Program Manager>>==G
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, KeyDatasTikdtTB.txt.2.dr Binary or memory string: [03:13:45]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:02]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:12]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:23]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatasTikdtTB.txt.2.dr, KeyDataWJHHDcgI.txt.2.dr Binary or memory string: [03:13:44]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.000000000122A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:22]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:11]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:10]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:24]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:46]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [3:14:03]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerex.com"01er
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:36]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerogram ManagerR
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:14]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:03]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManageroardD
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:02]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:00]<<Program Manager>>3:13
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05]<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:01]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 00]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:08]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:32]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:25]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:15]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataAgrYXqvU.txt.2.dr, KeyDataWJHHDcgI.txt.2.dr Binary or memory string: [03:13:42]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:51]<<Program Manager>>[03:C
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04]<<Program Manager^
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :02]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:06]<<Program Manager.trustedTypes;if(c&&c.createPolicy){try{b=c.createPolicy("goog#html",{createHTML:q,createScript:q,createScriptURL:q})}catch(d){p.console&&p.console.error(d.message)}U=b}else U=b}a=(b=U)?b.createScriptURL(a):a;return new V(a,Ta)};function ob(a,b){this.m=a;this.o=new Wa(a.document);this.g=b;this.j=S(this.g,1);this.u=nb(La(this.g,2));this.i=!1;b=nb(La(this.g,13));this.l=new db(a.document,b,S(this.g,12))}ob.prototype.start=function(){pb(this)};
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:00]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, KeyDataWJHHDcgI.txt.2.dr Binary or memory string: [03:13:43]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:34]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:17]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:50]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:09]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:33]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerA8252F1bwe
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 03:13:54]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:51]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:16]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:19]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: LC:\Users\user\AppData\Local\Adobe12:17]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:36]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:26]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manageroardm"01
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:29]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:06]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:27]<<Program Manager
Source: InstallUtil.exe, 0000000E.00000002.2485074504.000000000122A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B60000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.000000000121A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:28]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :26]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatadMAuPpXP.txt.2.dr Binary or memory string: [03:13:51]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:01]<<Program Manager
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataMwoscjvf.txt.2.dr Binary or memory string: [03:13:38]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:18]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:16]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:30]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:52]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:06]<<Program Manager>>03
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:16]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:03]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 03:14:01]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:40]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :04]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:05]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:19]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:27]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:13:48]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatalMReqyDc.txt.2.dr, KeyDataAgrYXqvU.txt.2.dr Binary or memory string: [03:13:41]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerex.com"nager9
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:14]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:49]<<Program Manager>>Prog
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:49]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:37]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager-release.ocx
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:54]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:21]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05]<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 4]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:10]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:48]<<Program Manager>>sv:C*
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, KeyDatakrnXjDpS.txt.2.dr, KeyDataYDwqSImV.txt.2.dr Binary or memory string: [03:13:58]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatasTLASBBX.txt.2.dr, KeyDataEHCgjwEU.txt.2.dr Binary or memory string: [03:13:31]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:39]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:21]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:03]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:56]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: LC:\Users\user\AppData\Local\Comms12:17]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:12]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp, KeyDataSojrcmUK.txt.2.dr Binary or memory string: [03:13:48]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :13:38]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:09]<<Program Manager>>Q
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:20]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:47]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:04]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:46]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:57]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:12:23]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:24]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [3:14:03]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp, KeyDataytxpjpTS.txt.2.dr Binary or memory string: [03:13:56]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataQusNBrHR.txt.2.dr, KeyDataQeSjVzIZ.txt.2.dr Binary or memory string: [03:13:34]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataytxpjpTS.txt.2.dr, KeyDataBXpKTjRE.txt.2.dr Binary or memory string: [03:13:55]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataQusNBrHR.txt.2.dr, KeyDataEHCgjwEU.txt.2.dr Binary or memory string: [03:13:33]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:00]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 03:14:04]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataEHCgjwEU.txt.2.dr Binary or memory string: [03:13:32]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataBXpKTjRE.txt.2.dr Binary or memory string: [03:13:54]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: :13:19]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:45]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:02]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.00000000011C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerogram Manager
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:23]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:44]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:01]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:22]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:05]<<Program Manager>>rogG
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:14:04]<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerex.com"nager1
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:58]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatayYYgRewy.txt.2.dr, KeyDataBXpKTjRE.txt.2.dr Binary or memory string: [03:13:53]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:52]<<Program Manager>>ogram
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:46]<<Program Manager>>es
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:55]<<Program Manager>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:26]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 3:13:53]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2486090424.00000000039D5000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:59]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:33]<<Program Manager>>anag
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:19]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:43]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataoZHPMIPe.txt.2.dr Binary or memory string: [03:12:09]<<Program Manager>>
Source: KeyDatalpqVYngJ.txt.2.dr, KeyDataQeSjVzIZ.txt.2.dr Binary or memory string: [03:13:36]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2483655901.000000000114B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:59]<<Program Manager\
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:42]<<Program Manager>>
Source: InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2483655901.000000000118A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:18]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 2:13]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDataQeSjVzIZ.txt.2.dr Binary or memory string: [03:13:35]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:13:46]<<Program Manager>>y
Source: InstallUtil.exe, 0000000E.00000002.2486543895.0000000003B77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 03:14:03]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2486090424.00000000039C0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2485074504.00000000011F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [03:12:25]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, KeyDatayYYgRewy.txt.2.dr, KeyDatadMAuPpXP.txt.2.dr Binary or memory string: [03:13:52]<<Program Manager>>
Source: InstallUtil.exe, 00000002.00000002.2482222234.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 13:53]<<Program Manager>>
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Facturas.exe Queries volume information: C:\Users\user\Desktop\Facturas.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Queries volume information: C:\Users\user\AppData\Roaming\Id.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Id.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Facturas.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DarkCloud
Source: Yara match File source: 13.2.Id.exe.3ff6f40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Id.exe.3ff6f40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Facturas.exe.3fc7d60.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Facturas.exe.3fc7d60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2479512482.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Facturas.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Id.exe PID: 7412, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7444, type: MEMORYSTR
Yara detected Generic Dropper
Source: Yara match File source: Process Memory Space: Facturas.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Id.exe PID: 7412, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior

Remote Access Functionality
barindex
Yara detected DarkCloud
Source: Yara match File source: 13.2.Id.exe.3ff6f40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.Id.exe.3ff6f40.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Facturas.exe.3fc7d60.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Facturas.exe.3fc7d60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.1411737595.0000000003FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2479512482.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256345226.0000000004070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.1411737595.0000000003D59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1256345226.0000000003F10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Facturas.exe PID: 7004, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Id.exe PID: 7412, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7444, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541874 Sample: Facturas.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 29 showip.net 2->29 33 Malicious sample detected (through community Yara rule) 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 10 other signatures 2->39 8 Facturas.exe 5 2->8         started        12 wscript.exe 1 2->12         started        signatures3 process4 file5 23 C:\Users\user\AppData\Roaming\Id.exe, PE32 8->23 dropped 25 C:\Users\user\AppData\Roaming\...\Id.vbs, ASCII 8->25 dropped 27 C:\Users\user\...\Id.exe:Zone.Identifier, ASCII 8->27 dropped 43 Drops VBS files to the startup folder 8->43 45 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->45 14 InstallUtil.exe 58 8->14         started        47 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->47 18 Id.exe 2 12->18         started        signatures6 process7 dnsIp8 31 showip.net 162.55.60.2, 49699, 49791, 80 ACPCA United States 14->31 49 Writes or reads registry keys via WMI 14->49 51 Antivirus detection for dropped file 18->51 53 Multi AV Scanner detection for dropped file 18->53 55 Machine Learning detection for dropped file 18->55 20 InstallUtil.exe 41 18->20         started        signatures9 process10 signatures11 41 Tries to harvest and steal browser information (history, passwords, etc) 20->41
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.55.60.2
 showip.net United States
35893 ACPCA false

Contacted Domains

Name IP Active
showip.net 162.55.60.2 true