Windows Analysis Report 6rfyiAq0nM

Overview

General Information

Sample Name: 6rfyiAq0nM (renamed file extension from none to msi)
Analysis ID: 508222
MD5: 623673851fbb205eb0d1003cb892d4d6
SHA1: c541b4e10541bb0a6565ba8cc6b64d2480ef4437
SHA256: 71a98e982a9dde0ffcf9a46554b7abaf947ac4c33f3a3b35df1a58b0064d0704
Tags: msi
Infos:

Most interesting Screenshot:

Detection

Cookie Stealer
Score: 74
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Cookie Stealer
Multi AV Scanner detection for submitted file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Query firmware table information (likely to detect VMs)
Allocates memory in foreign processes
Sigma detected: Suspicious Svchost Process
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Contains functionality to compare user and computer (likely to detect sandboxes)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Contains functionality to infect the boot sector
Contains functionality to steal Chrome passwords or cookies
Modifies the context of a thread in another process (thread injection)
Contains functionality to inject threads in other processes
Sets debug register (to hijack the execution of another thread)
Contains functionality to detect sleep reduction / modifications
Antivirus or Machine Learning detection for unpacked file
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to enumerate running services
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to simulate keystroke presses
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Contains functionality to retrieve information about pressed keystrokes
Checks for available system drives (often done to infect USB drives)
May check if the current machine is a sandbox (GetTickCount - Sleep)
Contains functionality to delete services
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
Contains functionality to shutdown / reboot the system
Creates files inside the system directory
Contains functionality to clear windows event logs (to hide its activities)
PE file contains sections with non-standard names
Stores large binary data to the registry
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Enables debug privileges
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to launch a program with higher privileges
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to simulate mouse events
Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: 6rfyiAq0nM.msi Virustotal: Detection: 31% Perma Link
Source: 6rfyiAq0nM.msi ReversingLabs: Detection: 35%
Multi AV Scanner detection for domain / URL
Source: https://fg.mygameagend.com/report7.4.php Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\ilovepdf\is-VR0CA.tmp ReversingLabs: Detection: 25%
Antivirus or Machine Learning detection for unpacked file
Source: 13.2.rundll32.exe.4eb0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 37.2.svchost.exe.1afba170000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 20.2.svchost.exe.1d91aad0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 28.0.svchost.exe.1111ac00000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 24.0.svchost.exe.1dc51fb0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 28.2.svchost.exe.1111ac00000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 24.2.svchost.exe.1dc51fb0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 37.0.svchost.exe.1afba170000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 30.2.svchost.exe.1be5cd40000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 17.0.svchost.exe.204f3380000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 27.2.svchost.exe.2743a320000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 34.2.svchost.exe.202b28f0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 16.2.svchost.exe.12e17870000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 34.0.svchost.exe.202b28f0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 19.2.svchost.exe.233426d0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 23.2.svchost.exe.28621cd0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 29.0.svchost.exe.22f12740000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 29.2.svchost.exe.22f12740000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 31.2.svchost.exe.21c23140000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 23.0.svchost.exe.28621cd0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 27.0.svchost.exe.2743a320000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 31.0.svchost.exe.21c23140000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 17.2.svchost.exe.204f3380000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 21.0.svchost.exe.2f2c5c00000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 38.0.svchost.exe.25c96c80000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 25.2.svchost.exe.2216b8b0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 30.0.svchost.exe.1be5cd40000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 22.0.svchost.exe.222cab20000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 22.2.svchost.exe.222cab20000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 14.2.svchost.exe.24b7d0d0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 19.0.svchost.exe.233426d0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 21.2.svchost.exe.2f2c5c00000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 38.2.svchost.exe.25c96c80000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 25.0.svchost.exe.2216b8b0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 14.0.svchost.exe.24b7d0d0000.0.unpack Avira: Label: TR/ATRAPS.Gen2
Source: 20.0.svchost.exe.1d91aad0000.0.unpack Avira: Label: TR/ATRAPS.Gen2

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198245C0 _fread_nolock,new,ImpersonateLoggedOnUser,CryptUnprotectData,RevertToSelf,LocalFree, 16_2_0000012E198245C0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19821320 ImpersonateLoggedOnUser,CryptUnprotectData,RevertToSelf,LocalFree, 16_2_0000012E19821320
Source: Binary string: 2"j.pdb source: is-30MA7.tmp.11.dr
Source: Binary string: .pdbYH source: is-UKPSI.tmp.11.dr

Spreading:

barindex
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC4560 lstrlenW,GetProcessImageFileNameW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,QueryDosDeviceW,QueryDosDeviceW,GetLastError,QueryDosDeviceW,lstrlenW,wsprintfW, 13_2_04EC4560
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0040AEF4 FindFirstFileW,FindClose, 10_2_0040AEF4
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 10_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0040E6A0 FindFirstFileW,FindClose, 11_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0060BC10 FindFirstFileW,GetLastError, 11_2_0060BC10
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 11_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_006B76A0 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose, 11_2_006B76A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB4C20 wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 13_2_04EB4C20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB56D0 FindFirstFileW,FindClose, 13_2_04EB56D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB4E30 wsprintfW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 13_2_04EB4E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB57F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 13_2_04EB57F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EE97D9 FindFirstFileExA, 13_2_04EE97D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB42B0 LocalAlloc,wsprintfW,FindFirstFileW,_wcsstr,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 13_2_04EB42B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB6A30 lstrcatW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 13_2_04EB6A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB53D0 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,std::_Xinvalid_argument, 13_2_04EB53D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC7390 lstrcpyW,lstrcatW,lstrcatW,CreateDirectoryW,GetLastError,GetLastError,FindFirstFileW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 13_2_04EC7390
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D5E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 14_2_0000024B7D0D5E30
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EAE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 14_2_0000024B7D0EAE60
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D57B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 14_2_0000024B7D0D57B0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D49FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 14_2_0000024B7D0D49FF
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D7A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 14_2_0000024B7D0D7A20
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D4AE3 FindFirstFileW,FindClose, 14_2_0000024B7D0D4AE3
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D63F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 14_2_0000024B7D0D63F0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D110478 FindFirstFileExA, 14_2_0000024B7D110478
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D4B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 14_2_0000024B7D0D4B90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17874AE3 FindFirstFileW,FindClose, 16_2_0000012E17874AE3
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178749FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 16_2_0000012E178749FF
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17877A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 16_2_0000012E17877A20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178757B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 16_2_0000012E178757B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17875E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 16_2_0000012E17875E30
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788AE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 16_2_0000012E1788AE60
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B0478 FindFirstFileExA, 16_2_0000012E178B0478
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178763F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 16_2_0000012E178763F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17874B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 16_2_0000012E17874B90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19805CF4 FindFirstFileExA, 16_2_0000012E19805CF4
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19823D90 FindFirstFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 16_2_0000012E19823D90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198EB2F0 FindFirstFileW,FreeEnvironmentStringsW,GetCommandLineA, 16_2_0000012E198EB2F0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 17_2_00000204F3384B90
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33863F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 17_2_00000204F33863F0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C0478 FindFirstFileExA, 17_2_00000204F33C0478
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384AE3 FindFirstFileW,FindClose, 17_2_00000204F3384AE3
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33849FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 17_2_00000204F33849FF
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3387A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 17_2_00000204F3387A20
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33857B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 17_2_00000204F33857B0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3385E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW, 17_2_00000204F3385E30
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339AE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 17_2_00000204F339AE60

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 1948 DNS zone transfer UDP 192.168.2.3:60785 -> 34.64.183.91:53
Source: Traffic Snort IDS: 1948 DNS zone transfer UDP 192.168.2.3:53947 -> 34.64.183.91:53
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\svchost.exe Domain query: toa.mygametoa.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: bh.mygameadmin.comContent-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: fg.mygameagend.comContent-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: bh.mygameadmin.comContent-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: bh.mygameadmin.comContent-Length: 558Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: bh.mygameadmin.comContent-Length: 254Connection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exehttp://support.app
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: svchost.exe, 00000010.00000003.423921823.0000012E176DB000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.533396950.00000204F3000000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000011.00000002.533096417.00000204EFAAD000.00000004.00000001.sdmp String found in binary or memory: http://crl.ver)
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exerequires_authorizationstatus
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_ushttp://service.real.com/realplayer/secu
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: svchost.exe String found in binary or memory: http://ip-api.com/json/?fields=8198
Source: svchost.exe, 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp String found in binary or memory: http://ip-api.com/json/?fields=8198countryCoderegionquerymachineidipverchannelid8.9mverp=https://bh.
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://subca.ocsp-certum.com01
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://support.apple.com/kb/HT203092
Source: is-30MA7.tmp.11.dr, is-UKPSI.tmp.11.dr String found in binary or memory: http://w.ijg.
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: http://www.certum.pl/CPS0
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://www.google.com/earth/explore/products/plugin.htmlWe
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chromedisplayurl
Source: svchost.exe, 00000022.00000000.396013694.00000202B1A76000.00000004.00000001.sdmp, svchost.exe, 00000022.00000000.394067819.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https:///WAB-23B4D62B-952A-47E7-969C-B95DBF145D3D.local
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https:///live.com
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https:///windows.net
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https:///xboxlive.com
Source: svchost.exe, 00000010.00000002.816396441.0000012E176C2000.00000004.00000001.sdmp String found in binary or memory: https://bh.mygameadmin.com/
Source: svchost.exe String found in binary or memory: https://bh.mygameadmin.com/report7.4.php
Source: svchost.exe, 00000010.00000002.816396441.0000012E176C2000.00000004.00000001.sdmp String found in binary or memory: https://bh.mygameadmin.com/report7.4.phpile
Source: svchost.exe, 00000010.00000002.828608076.0000012E1962A000.00000004.00000001.sdmp String found in binary or memory: https://fg.mygameagend.com/
Source: svchost.exe, 00000010.00000002.828608076.0000012E1962A000.00000004.00000001.sdmp String found in binary or memory: https://fg.mygameagend.com/dll
Source: svchost.exe String found in binary or memory: https://fg.mygameagend.com/report7.4.php
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: https://jrsoftware.org/
Source: MSIFBC3.tmp String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: MSIFBC3.tmp, 0000000A.00000002.440932524.0000000000401000.00000020.00020000.sdmp, 6rfyiAq0nM.msi String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: https://jrsoftware.org0
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp, svchost.exe, 00000022.00000000.396013694.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp, svchost.exe, 00000022.00000002.812144840.00000202B1A5D000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000022.00000000.396013694.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp, svchost.exe, 00000022.00000000.395963998.00000202B1A5D000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/7E5B
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.netB7E5B
Source: svchost.exe, 00000022.00000000.395963998.00000202B1A5D000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.netll
Source: svchost.exe, 00000022.00000000.394067819.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.netm
Source: svchost.exe, 00000010.00000003.421876578.0000012E1764D000.00000004.00000001.sdmp String found in binary or memory: https://p-api.com/json/?fields=8198
Source: svchost.exe String found in binary or memory: https://pcbmhome.com/click.php?cnv_id=%s&cl=%d
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: https://sectigo.com/CPS0D
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_divxvideo/x-matroskavideo/divx
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashapplication/futuresplashapplication/x-shockwave-fla
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_javaapplication/x-java-appletapplication/x-java-applet;j
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdfapplication/pdfapplication/vnd.adobe.x-marsapplicatio
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktimeapplication/sdpapplication/x-mpegapplication/x-
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_realaudio/vnd.rn-realaudiovideo/vnd.rn-realvideoaudio/x-
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwaveapplication/x-director
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmpWindows
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: MSIFBC3.tmp, 0000000B.00000003.295234957.0000000003530000.00000004.00000001.sdmp, _isdecmp.dll.11.dr String found in binary or memory: https://www.certum.pl/CPS0
Source: MSIFBC3.tmp, MSIFBC3.tmp, 0000000B.00000002.438263058.0000000000401000.00000020.00020000.sdmp, MSIFBC3.tmp.10.dr String found in binary or memory: https://www.innosetup.com/
Source: svchost.exe String found in binary or memory: https://www.instagram.com/accounts/edit/
Source: MSIFBC3.tmp, MSIFBC3.tmp.10.dr String found in binary or memory: https://www.remobjects.com/ps
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000022.00000000.396013694.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com-969C-B95DBF145D3D.local
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com/
Source: svchost.exe, 00000022.00000002.812792444.00000202B1A76000.00000004.00000001.sdmp String found in binary or memory: https://xsts.auth.xboxlive.com2
Source: unknown DNS traffic detected: queries for: toa.mygametoa.com
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ECDFF0 recv,SetLastError,GetLastError,WSAGetLastError, 13_2_04ECDFF0
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: Facebook Video Callinghttps://www.facebook.com/chat/video/videocalldownload.phpWe do not track version information for the Facebook Video Calling Plugin.requires_authorizationcomment equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/ads/manager/account_settings/account_billing equals www.facebook.com (Facebook)
Source: svchost.exe, 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp String found in binary or memory: https://www.facebook.com/ads/manager/account_settings/account_billing""token":"async_get_token":""ACCOUNT_ID":""USER_ID":"{"adAccountID":"{access_token:"{"sessionID":"account_currency_ratio_to_usd:https://www.facebook.com/ajax/settings/account/email.php?__a=1&fb_dtsg_ag=@@https://www.facebook.com/profile.php"displayable_count":"section_type":"FRIENDS"__a=1&fb_dtsg=https://www.facebook.com/personal_settings/page_items/for (;;);payloaditemsfb_dtsg=&variables=%7B%22pagination%22%3A%7B%22after%22%3A%220%22%2C%22num_items%22%3A3%7D%2C%22query_params%22%3A%7B%22payment_type%22%3A%22FBPAY_HUB%22%7D%7D&server_timestamps=true&doc_id=3475732812534491https://secure.facebook.com/api/graphql/datapayment_method_infoavailable_payment_optionscc_typeCREDIT_CARD__a=1&av=&__user=&fb_dtsg=&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=AccountQualityHubAssetOwnerViewQuery&variables={"assetOwnerId":"","startTime":1612137600}&doc_id=3739963982749339https://www.facebook.com/api/graphql/viewerDatadefault_businessnodeshttps://www.facebook.com/adsmanager/manage/accounts?act="adtrust_dsl":av=&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=BillingAMNexusRootQuery&variables={"paymentAccountID":""}&doc_id=4075226092554060billable_account_by_payment_accountaccount_statusDISABLEDACTIVEbalanceformattedbillable_account_tax_infobusiness_country_codecurrencystored_balance_statusprepay_account_balancebilling_threshold_currency_amountformatted_amountbilling_payment_accountbilling_payment_methodscredential__typenameExternalCreditCardPaymentPaypalBillingAgreementStoredBalanceExtendedCredit&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=AccountQualityHubLandingPageQuery&doc_id=3953057938071449viewerad_accountsadvertising_restriction_infois_restrictedrestriction_daterestriction_typeaccount_user&variables=%7B%22paymentAccountID%22%3A%22%22%2C%22count%22%3A10%2C%22cursor%22%3Anull%2C%22filters%22%3A%5B%5D%2C%22start_time%22%3A1281628800%2C%22end_time%22%3A1630425600%7D&&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=BillingTransactionTableQuery&doc_id=5015578711817965billing_txnsedgesflow=logged_in_settings&reload=1&__a=1&__user=https://www.facebook.com/login/device-based/turn-on/00000000000000000000000000000000SOFTWARE\Classes\CLSID\{SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}2https://pcbmhome.com/click.php?cnv_id=%s&cl=%dfacebook.comkernel32.dllRtlGetNtVersionNumbersntdll.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%sInstallLocation\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\%sGoogle ChromeMicrosoft EdgeYandexBrowserSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\UninstallLauncher.exehttps://www.instagram.com/accounts/edit/"viewerId":""username":""email":""phone_number":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36HTTP/1.0Cookie: equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/adsmanager/manage/accounts?act= equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/ajax/settings/account/email.php?__a=1&fb_dtsg_ag= equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/api/graphql/ equals www.facebook.com (Facebook)
Source: svchost.exe, 00000010.00000003.421707940.0000012E1967C000.00000004.00000001.sdmp String found in binary or memory: https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/login/device-based/turn-on/ equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/personal_settings/page_items/ equals www.facebook.com (Facebook)
Source: svchost.exe String found in binary or memory: https://www.facebook.com/profile.php equals www.facebook.com (Facebook)
Source: svchost.exe, 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp String found in binary or memory: https://www.facebook.comPragma: no-cache equals www.facebook.com (Facebook)
Source: unknown HTTP traffic detected: POST /report7.4.php HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36Host: bh.mygameadmin.comContent-Length: 278Connection: Keep-AliveCache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBB820 GetAsyncKeyState,Sleep,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState, 13_2_04EBB820
Contains functionality for read data from the clipboard
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB74A0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard, 13_2_04EB74A0
Contains functionality to read the clipboard data
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB7500 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalSize,GlobalUnlock,CloseClipboard, 13_2_04EB7500
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB6590 CreateEventW,OpenDesktopW,CreateDesktopW,SetThreadDesktop,GetDesktopWindow,MonitorFromWindow,GetMonitorInfoW,EnumDisplaySettingsW,GetDC,CreateCompatibleDC,GetVersionExA, 13_2_04EB6590

System Summary:

barindex
Detected potential crypto function
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004323DC 10_2_004323DC
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004255DC 10_2_004255DC
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0040E9C4 10_2_0040E9C4
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_006B6128 11_2_006B6128
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0040C938 11_2_0040C938
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EED4C1 13_2_04EED4C1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB1C60 13_2_04EB1C60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EF0C01 13_2_04EF0C01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBC540 13_2_04EBC540
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EE77D9 13_2_04EE77D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EDC770 13_2_04EDC770
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EDAF40 13_2_04EDAF40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EDA860 13_2_04EDA860
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED11A0 13_2_04ED11A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED69B0 13_2_04ED69B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBC990 13_2_04EBC990
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ECA160 13_2_04ECA160
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED73ED 13_2_04ED73ED
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBBBF0 13_2_04EBBBF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EE5B60 13_2_04EE5B60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04D93CAB 13_2_04D93CAB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04D7A0D5 13_2_04D7A0D5
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EC6B0 14_2_0000024B7D0EC6B0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EF5E0 14_2_0000024B7D0EF5E0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E0E00 14_2_0000024B7D0E0E00
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E4E00 14_2_0000024B7D0E4E00
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FBE25 14_2_0000024B7D0FBE25
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E6E10 14_2_0000024B7D0E6E10
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D9640 14_2_0000024B7D0D9640
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E4660 14_2_0000024B7D0E4660
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D10BEE0 14_2_0000024B7D10BEE0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FC575 14_2_0000024B7D0FC575
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D10DDC4 14_2_0000024B7D10DDC4
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D10C5B0 14_2_0000024B7D10C5B0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E6010 14_2_0000024B7D0E6010
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D10680C 14_2_0000024B7D10680C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D10A068 14_2_0000024B7D10A068
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F4070 14_2_0000024B7D0F4070
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D1008E0 14_2_0000024B7D1008E0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D1148CC 14_2_0000024B7D1148CC
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D119EFD 14_2_0000024B7D119EFD
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0DF730 14_2_0000024B7D0DF730
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0ECF50 14_2_0000024B7D0ECF50
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D2FA0 14_2_0000024B7D0D2FA0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E8FB0 14_2_0000024B7D0E8FB0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0DE200 14_2_0000024B7D0DE200
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D11026C 14_2_0000024B7D11026C
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D5280 14_2_0000024B7D0D5280
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D92C0 14_2_0000024B7D0D92C0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D100100 14_2_0000024B7D100100
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D8100 14_2_0000024B7D0D8100
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D11A116 14_2_0000024B7D11A116
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E1150 14_2_0000024B7D0E1150
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E8190 14_2_0000024B7D0E8190
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D1179DC 14_2_0000024B7D1179DC
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0E51D0 14_2_0000024B7D0E51D0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EE450 14_2_0000024B7D0EE450
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FE480 14_2_0000024B7D0FE480
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FBC8D 14_2_0000024B7D0FBC8D
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F0CB0 14_2_0000024B7D0F0CB0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EB4B0 14_2_0000024B7D0EB4B0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F72F0 14_2_0000024B7D0F72F0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FC31E 14_2_0000024B7D0FC31E
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F8310 14_2_0000024B7D0F8310
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D102360 14_2_0000024B7D102360
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D7380 14_2_0000024B7D0D7380
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0DEBD0 14_2_0000024B7D0DEBD0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7C9A02E8 14_2_0000024B7C9A02E8
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17881150 16_2_0000012E17881150
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788F5E0 16_2_0000012E1788F5E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17890CB0 16_2_0000012E17890CB0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788E450 16_2_0000012E1788E450
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1787EBD0 16_2_0000012E1787EBD0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178972F0 16_2_0000012E178972F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17898310 16_2_0000012E17898310
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789C31E 16_2_0000012E1789C31E
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178A2360 16_2_0000012E178A2360
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17875280 16_2_0000012E17875280
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178792C0 16_2_0000012E178792C0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1787E200 16_2_0000012E1787E200
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B026C 16_2_0000012E178B026C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17888190 16_2_0000012E17888190
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B79DC 16_2_0000012E178B79DC
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178851D0 16_2_0000012E178851D0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17878100 16_2_0000012E17878100
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178A0100 16_2_0000012E178A0100
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178BA116 16_2_0000012E178BA116
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17894070 16_2_0000012E17894070
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B48CC 16_2_0000012E178B48CC
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178A08E0 16_2_0000012E178A08E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178A680C 16_2_0000012E178A680C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17886010 16_2_0000012E17886010
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178AA068 16_2_0000012E178AA068
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17872FA0 16_2_0000012E17872FA0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17888FB0 16_2_0000012E17888FB0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B9EFD 16_2_0000012E178B9EFD
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1787F730 16_2_0000012E1787F730
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788CF50 16_2_0000012E1788CF50
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788C6B0 16_2_0000012E1788C6B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178ABEE0 16_2_0000012E178ABEE0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17880E00 16_2_0000012E17880E00
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17884E00 16_2_0000012E17884E00
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17886E10 16_2_0000012E17886E10
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789BE25 16_2_0000012E1789BE25
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17879640 16_2_0000012E17879640
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17884660 16_2_0000012E17884660
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789C575 16_2_0000012E1789C575
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178AC5B0 16_2_0000012E178AC5B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178ADDC4 16_2_0000012E178ADDC4
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789BC8D 16_2_0000012E1789BC8D
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789E480 16_2_0000012E1789E480
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788B4B0 16_2_0000012E1788B4B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17877380 16_2_0000012E17877380
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1980ACA8 16_2_0000012E1980ACA8
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198044D4 16_2_0000012E198044D4
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19805AE8 16_2_0000012E19805AE8
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19821731 16_2_0000012E19821731
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198245C0 16_2_0000012E198245C0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19821D97 16_2_0000012E19821D97
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1987B510 16_2_0000012E1987B510
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984C530 16_2_0000012E1984C530
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19834480 16_2_0000012E19834480
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198894C0 16_2_0000012E198894C0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1989C410 16_2_0000012E1989C410
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19832430 16_2_0000012E19832430
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984B380 16_2_0000012E1984B380
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198AC380 16_2_0000012E198AC380
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198493E0 16_2_0000012E198493E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198953E0 16_2_0000012E198953E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198A8740 16_2_0000012E198A8740
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198816E0 16_2_0000012E198816E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198745F0 16_2_0000012E198745F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984F5F0 16_2_0000012E1984F5F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1982A600 16_2_0000012E1982A600
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1985D64A 16_2_0000012E1985D64A
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D7654 16_2_0000012E198D7654
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984A660 16_2_0000012E1984A660
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D6910 16_2_0000012E198D6910
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1988C950 16_2_0000012E1988C950
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D88B0 16_2_0000012E198D88B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D88B0 16_2_0000012E198D88B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1987C8D0 16_2_0000012E1987C8D0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198358E0 16_2_0000012E198358E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198E1844 16_2_0000012E198E1844
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19890844 16_2_0000012E19890844
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1983285B 16_2_0000012E1983285B
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19896780 16_2_0000012E19896780
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198237AF 16_2_0000012E198237AF
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19899AF0 16_2_0000012E19899AF0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19842B10 16_2_0000012E19842B10
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19898A90 16_2_0000012E19898A90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198A1AA0 16_2_0000012E198A1AA0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19829A20 16_2_0000012E19829A20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D9A34 16_2_0000012E198D9A34
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19846A50 16_2_0000012E19846A50
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19880A60 16_2_0000012E19880A60
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1985DD37 16_2_0000012E1985DD37
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19850D40 16_2_0000012E19850D40
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19839D55 16_2_0000012E19839D55
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198DEC74 16_2_0000012E198DEC74
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984EC80 16_2_0000012E1984EC80
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19887C80 16_2_0000012E19887C80
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19855CD0 16_2_0000012E19855CD0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19829CE0 16_2_0000012E19829CE0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19838C20 16_2_0000012E19838C20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19865C30 16_2_0000012E19865C30
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198B3C60 16_2_0000012E198B3C60
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19857B80 16_2_0000012E19857B80
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19885BAD 16_2_0000012E19885BAD
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198B1BD0 16_2_0000012E198B1BD0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198A7F20 16_2_0000012E198A7F20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1985CF3F 16_2_0000012E1985CF3F
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984FE00 16_2_0000012E1984FE00
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198E3E20 16_2_0000012E198E3E20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1984AE40 16_2_0000012E1984AE40
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19825080 16_2_0000012E19825080
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19828090 16_2_0000012E19828090
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19834FF0 16_2_0000012E19834FF0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1987BFF0 16_2_0000012E1987BFF0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198B3030 16_2_0000012E198B3030
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198ADF70 16_2_0000012E198ADF70
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1989033F 16_2_0000012E1989033F
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19867270 16_2_0000012E19867270
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1989B2B0 16_2_0000012E1989B2B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1982A210 16_2_0000012E1982A210
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19898260 16_2_0000012E19898260
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19887190 16_2_0000012E19887190
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198BB1B0 16_2_0000012E198BB1B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E174902E8 16_2_0000012E174902E8
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339F5E0 17_2_00000204F339F5E0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339B4B0 17_2_00000204F339B4B0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A0CB0 17_2_00000204F33A0CB0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33ABC8D 17_2_00000204F33ABC8D
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33AC575 17_2_00000204F33AC575
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F338EBD0 17_2_00000204F338EBD0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33AE480 17_2_00000204F33AE480
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339E450 17_2_00000204F339E450
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33892C0 17_2_00000204F33892C0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A72F0 17_2_00000204F33A72F0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33AC31E 17_2_00000204F33AC31E
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A8310 17_2_00000204F33A8310
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3387380 17_2_00000204F3387380
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33B2360 17_2_00000204F33B2360
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3398190 17_2_00000204F3398190
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F338E200 17_2_00000204F338E200
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C79DC 17_2_00000204F33C79DC
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33951D0 17_2_00000204F33951D0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3385280 17_2_00000204F3385280
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C026C 17_2_00000204F33C026C
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3388100 17_2_00000204F3388100
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33B0100 17_2_00000204F33B0100
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33B08E0 17_2_00000204F33B08E0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C48CC 17_2_00000204F33C48CC
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33CA116 17_2_00000204F33CA116
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3391150 17_2_00000204F3391150
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3398FB0 17_2_00000204F3398FB0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3382FA0 17_2_00000204F3382FA0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33B680C 17_2_00000204F33B680C
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3396010 17_2_00000204F3396010
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A4070 17_2_00000204F33A4070
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33BA068 17_2_00000204F33BA068
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339C6B0 17_2_00000204F339C6B0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C9EFD 17_2_00000204F33C9EFD
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33BBEE0 17_2_00000204F33BBEE0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F338F730 17_2_00000204F338F730
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339CF50 17_2_00000204F339CF50
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33BC5B0 17_2_00000204F33BC5B0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3390E00 17_2_00000204F3390E00
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3394E00 17_2_00000204F3394E00
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33BDDC4 17_2_00000204F33BDDC4
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3389640 17_2_00000204F3389640
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33ABE25 17_2_00000204F33ABE25
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3396E10 17_2_00000204F3396E10
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3394660 17_2_00000204F3394660
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F32C02E8 17_2_00000204F32C02E8
Contains functionality to launch a process as a different user
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC98E0 GetVersionExW,GetProcAddress,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetSystemDirectoryW,wsprintfW,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,Sleep,GetCurrentProcess,OpenProcessToken,DuplicateTokenEx,SetTokenInformation,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CreateProcessAsUserW,CloseHandle,CreateProcessW,LoadLibraryA,GetProcAddress,CloseHandle,GetThreadContext,VirtualAllocEx,TerminateProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,WaitForSingleObject,CloseHandle,WaitForSingleObject,OpenThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle, 13_2_04EC98E0
PE file contains strange resources
Source: MSIFBC3.tmp.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSIFBC3.tmp.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSIFBC3.tmp.10.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: MSIFBC3.tmp.10.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: MSIFBC3.tmp.10.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JDQA9.tmp.11.dr Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-JDQA9.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JDQA9.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-CU1EC.tmp.11.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Contains functionality to delete services
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC3A20 OpenSCManagerW,OpenServiceW,QueryServiceStatus,ControlService,Sleep,DeleteService,wsprintfW,SHDeleteKeyW,CloseServiceHandle,CloseServiceHandle, 13_2_04EC3A20
Yara signature match
Source: 27.2.svchost.exe.2743a320000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 34.2.svchost.exe.202b28f0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 20.2.svchost.exe.1d91aad0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 24.2.svchost.exe.1dc51fb0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 37.2.svchost.exe.1afba170000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 13.2.rundll32.exe.4eb0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 28.2.svchost.exe.1111ac00000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 30.2.svchost.exe.1be5cd40000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 16.2.svchost.exe.12e17870000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 28.0.svchost.exe.1111ac00000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 34.0.svchost.exe.202b28f0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 25.2.svchost.exe.2216b8b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 17.0.svchost.exe.204f3380000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 34.0.svchost.exe.202b28f0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 38.0.svchost.exe.25c96c80000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 27.2.svchost.exe.2743a320000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 37.0.svchost.exe.1afba170000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 19.2.svchost.exe.233426d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 22.0.svchost.exe.222cab20000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 25.0.svchost.exe.2216b8b0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 30.0.svchost.exe.1be5cd40000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 14.0.svchost.exe.24b7d0d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 24.0.svchost.exe.1dc51fb0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 21.0.svchost.exe.2f2c5c00000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 17.2.svchost.exe.204f3380000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 37.2.svchost.exe.1afba170000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 28.2.svchost.exe.1111ac00000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 31.2.svchost.exe.21c23140000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 23.2.svchost.exe.28621cd0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 27.0.svchost.exe.2743a320000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 30.2.svchost.exe.1be5cd40000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 29.0.svchost.exe.22f12740000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 28.0.svchost.exe.1111ac00000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 23.0.svchost.exe.28621cd0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 29.2.svchost.exe.22f12740000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 31.2.svchost.exe.21c23140000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 13.2.rundll32.exe.4eb0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 31.0.svchost.exe.21c23140000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 27.0.svchost.exe.2743a320000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 25.2.svchost.exe.2216b8b0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 17.2.svchost.exe.204f3380000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 21.0.svchost.exe.2f2c5c00000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 38.2.svchost.exe.25c96c80000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 14.2.svchost.exe.24b7d0d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 34.2.svchost.exe.202b28f0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 30.0.svchost.exe.1be5cd40000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 14.2.svchost.exe.24b7d0d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 38.0.svchost.exe.25c96c80000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 22.2.svchost.exe.222cab20000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 22.0.svchost.exe.222cab20000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 19.0.svchost.exe.233426d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 31.0.svchost.exe.21c23140000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 19.0.svchost.exe.233426d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 23.2.svchost.exe.28621cd0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 20.2.svchost.exe.1d91aad0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 24.0.svchost.exe.1dc51fb0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 29.2.svchost.exe.22f12740000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 17.0.svchost.exe.204f3380000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 22.2.svchost.exe.222cab20000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 29.0.svchost.exe.22f12740000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 21.2.svchost.exe.2f2c5c00000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 21.2.svchost.exe.2f2c5c00000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 16.2.svchost.exe.12e17870000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 19.2.svchost.exe.233426d0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 20.0.svchost.exe.1d91aad0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 25.0.svchost.exe.2216b8b0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 38.2.svchost.exe.25c96c80000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 23.0.svchost.exe.28621cd0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 24.2.svchost.exe.1dc51fb0000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 37.0.svchost.exe.1afba170000.0.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 14.0.svchost.exe.24b7d0d0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 20.0.svchost.exe.1d91aad0000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000014.00000003.340502864.000001D91AA60000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000015.00000003.343737038.000002F2C5B90000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001E.00000003.383962907.000001BE5C730000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000022.00000000.397199381.00000202B28F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001D.00000003.379846771.0000022F12180000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000025.00000000.402119778.000001AFBA170000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000026.00000002.829615785.0000025C96C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000019.00000003.363362333.000002216B840000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000002.814263097.0000012E17674000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000018.00000002.815503783.000001DC51FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001F.00000000.389374530.0000021C23140000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.423845789.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.341269563.0000012E17682000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000025.00000002.820529720.000001AFBA170000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000015.00000002.823826621.000002F2C5C00000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000013.00000000.337739160.00000233426D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000014.00000002.813792020.000001D91AAD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.423609117.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000000D.00000002.415787297.0000000004D00000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000000E.00000003.327914667.0000024B7D060000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.428213354.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000017.00000002.815819484.0000028621CD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000013.00000003.337258636.0000023342660000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001E.00000000.384736630.000001BE5CD40000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001F.00000003.387366099.0000021C22B80000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000000D.00000002.415946366.0000000004EB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001B.00000002.832381229.000002743A320000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000014.00000000.341208175.000001D91AAD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001C.00000002.813715548.000001111AC00000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000026.00000003.406745863.0000025C96370000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000016.00000003.347514859.00000222CAAB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.425960077.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001B.00000000.373121190.000002743A320000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000016.00000002.815078501.00000222CAB20000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.422182454.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000011.00000000.334220088.00000204F3380000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001B.00000003.369691335.000002743A2B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000017.00000003.351653681.0000028621C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000002.818890783.0000012E17800000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000025.00000003.400991197.000001AFBA100000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000016.00000000.348676580.00000222CAB20000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001F.00000002.812231248.0000021C23140000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000015.00000000.344698282.000002F2C5C00000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000011.00000002.535149996.00000204F3380000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000000E.00000000.328311763.0000024B7D0D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001C.00000000.376992650.000001111AC00000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001C.00000003.376362360.000001111A990000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001D.00000002.816236528.0000022F12740000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000018.00000000.360038212.000001DC51FB0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000011.00000003.332207196.00000204F3310000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000022.00000002.818183114.00000202B28F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001E.00000002.817922653.000001BE5CD40000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000019.00000002.819987063.000002216B8B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000018.00000003.358956520.000001DC51F40000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000022.00000003.395183978.00000202B2880000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.347751954.0000012E17682000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000002.831136310.0000012E1A230000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 00000010.00000002.831136310.0000012E1A230000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000000E.00000002.813201421.0000024B7D0D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000019.00000000.364403941.000002216B8B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000026.00000000.409308294.0000025C96C80000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000013.00000002.814492712.00000233426D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 0000001D.00000000.380584076.0000022F12740000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000002.822239151.0000012E17870000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.422945945.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000017.00000000.353917574.0000028621CD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: 00000010.00000003.422081412.0000012E1768F000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings, score =
Source: C:\Program Files (x86)\ilovepdf\is-93C0J.tmp, type: DROPPED Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIFBC3.tmp Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 10_2_004AF110
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\3cf0a5.msi Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E178BB6B8 appears 32 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E178BB6A8 appears 40 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E198530B0 appears 33 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000024B7D11B6A8 appears 39 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 00000204F33CB848 appears 39 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000024B7D11B6B8 appears 32 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E19856620 appears 53 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E19833D40 appears 38 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000024B7D11B848 appears 39 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E19834D50 appears 129 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 00000204F33CB6A8 appears 39 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 00000204F33CB6B8 appears 32 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E19834000 appears 149 times
Source: C:\Windows\System32\svchost.exe Code function: String function: 0000012E178BB848 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 0060C688 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 00615D14 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 005DD7A8 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 005F4B90 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 005F4E74 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: String function: 00615A90 appears 37 times
Contains functionality to communicate with device drivers
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC6740: GetModuleHandleA,GetProcAddress,CreateFileA,DeviceIoControl,CloseHandle, 13_2_04EC6740
PE file contains executable resources (Code or Archives)
Source: MSIFBC3.tmp.10.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-JDQA9.tmp.11.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: 6rfyiAq0nM.msi Binary or memory string: OriginalFileName vs 6rfyiAq0nM.msi
Source: is-93C0J.tmp.11.dr Static PE information: Section: UPX1 ZLIB complexity 0.990987760073
Source: is-30MA7.tmp.11.dr Static PE information: Section: UPX1 ZLIB complexity 0.990885780988
Source: is-8KFAQ.tmp.11.dr Static PE information: Section: UPX1 ZLIB complexity 0.991569422468
Source: is-UKPSI.tmp.11.dr Static PE information: Section: UPX1 ZLIB complexity 0.991049810131
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: classification engine Classification label: mal74.troj.spyw.evad.winMSI@10/39@2/5
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC3710 OpenSCManagerW,OpenServiceW,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle, 13_2_04EC3710
Source: 6rfyiAq0nM Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004AF9F0 FindResourceW,SizeofResource,LoadResource,LockResource, 10_2_004AF9F0
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: 6rfyiAq0nM.msi Virustotal: Detection: 31%
Source: 6rfyiAq0nM.msi ReversingLabs: Detection: 35%
Source: C:\Windows\Installer\MSIFBC3.tmp Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\msiexec.exe 'C:\Windows\System32\msiexec.exe' /i 'C:\Users\user\Desktop\6rfyiAq0nM.msi'
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\Installer\MSIFBC3.tmp C:\Windows\Installer\MSIFBC3.tmp
Source: C:\Windows\Installer\MSIFBC3.tmp Process created: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp 'C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp' /SL5='$9025C,6374824,780800,C:\Windows\Installer\MSIFBC3.tmp'
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rUNdLl32.Exe' 'C:\Program Files (x86)\ilovepdf\sqlite.dll',global
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k SystemNetworkService
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\Installer\MSIFBC3.tmp C:\Windows\Installer\MSIFBC3.tmp Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Process created: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp 'C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp' /SL5='$9025C,6374824,780800,C:\Windows\Installer\MSIFBC3.tmp' Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rUNdLl32.Exe' 'C:\Program Files (x86)\ilovepdf\sqlite.dll',global Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k SystemNetworkService Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 10_2_004AF110
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ECAA70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle, 13_2_04ECAA70
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EDA60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle, 14_2_0000024B7D0EDA60
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788DA60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle, 16_2_0000012E1788DA60
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339DA60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle, 17_2_00000204F339DA60
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\TEMP\~DFAE8A96F5E4660E33.TMP Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0062C764 GetVersion,CoCreateInstance, 11_2_0062C764
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0041A4DC GetDiskFreeSpaceW, 10_2_0041A4DC
Source: svchost.exe Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: svchost.exe Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: svchost.exe Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: svchost.exe, 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC5C60 GetModuleFileNameW,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,FindCloseChangeNotification, 13_2_04EC5C60
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rUNdLl32.Exe' 'C:\Program Files (x86)\ilovepdf\sqlite.dll',global
Source: 6rfyiAq0nM.msi Static file information: TRID: Microsoft Windows Installer (77509/1) 90.59%
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 6rfyiAq0nM.msi Static file information: File size 7306752 > 1048576
Source: Binary string: 2"j.pdb source: is-30MA7.tmp.11.dr
Source: Binary string: .pdbYH source: is-UKPSI.tmp.11.dr

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004B5000 push 004B50DEh; ret 10_2_004B50D6
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004B5980 push 004B5A48h; ret 10_2_004B5A40
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00458000 push ecx; mov dword ptr [esp], ecx 10_2_00458005
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0049B03C push ecx; mov dword ptr [esp], edx 10_2_0049B03D
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004A00F8 push ecx; mov dword ptr [esp], edx 10_2_004A00F9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00458084 push ecx; mov dword ptr [esp], ecx 10_2_00458089
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004B1084 push 004B10ECh; ret 10_2_004B10E4
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004A1094 push ecx; mov dword ptr [esp], edx 10_2_004A1095
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0041A0B4 push ecx; mov dword ptr [esp], ecx 10_2_0041A0B8
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004270BC push 00427104h; ret 10_2_004270FC
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00458108 push ecx; mov dword ptr [esp], ecx 10_2_0045810D
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004321C8 push ecx; mov dword ptr [esp], edx 10_2_004321C9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004A21D8 push ecx; mov dword ptr [esp], edx 10_2_004A21D9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0049E1B8 push ecx; mov dword ptr [esp], edx 10_2_0049E1B9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0049A260 push 0049A378h; ret 10_2_0049A370
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00455268 push ecx; mov dword ptr [esp], ecx 10_2_0045526C
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004252D4 push ecx; mov dword ptr [esp], eax 10_2_004252D9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004592FC push ecx; mov dword ptr [esp], edx 10_2_004592FD
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0045B284 push ecx; mov dword ptr [esp], edx 10_2_0045B285
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00430358 push ecx; mov dword ptr [esp], eax 10_2_00430359
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00430370 push ecx; mov dword ptr [esp], eax 10_2_00430371
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00459394 push ecx; mov dword ptr [esp], ecx 10_2_00459398
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004A1428 push ecx; mov dword ptr [esp], edx 10_2_004A1429
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0049B424 push ecx; mov dword ptr [esp], edx 10_2_0049B425
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004A24D8 push ecx; mov dword ptr [esp], edx 10_2_004A24D9
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004224F0 push 004225F4h; ret 10_2_004225EC
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004304F0 push ecx; mov dword ptr [esp], eax 10_2_004304F1
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00499490 push ecx; mov dword ptr [esp], edx 10_2_00499493
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00458564 push ecx; mov dword ptr [esp], edx 10_2_00458565
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00458574 push ecx; mov dword ptr [esp], edx 10_2_00458575
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00457574 push ecx; mov dword ptr [esp], ecx 10_2_00457578
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC8FD0 CloseServiceHandle,LoadLibraryA,LoadLibraryA,GetProcAddress,RtlAdjustPrivilege,OpenProcess,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,FindCloseChangeNotification,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 13_2_04EC8FD0
PE file contains sections with non-standard names
Source: MSIFBC3.tmp.2.dr Static PE information: section name: .didata
Source: MSIFBC3.tmp.10.dr Static PE information: section name: .didata
Source: is-JDQA9.tmp.11.dr Static PE information: section name: .didata
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1

Persistence and Installation Behavior:

barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\System32\msiexec.exe Executable created and started: C:\Windows\Installer\MSIFBC3.tmp Jump to behavior
Contains functionality to infect the boot sector
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetModuleHandleA,GetProcAddress,CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive0 13_2_04EC6740
Source: C:\Windows\System32\svchost.exe Code function: GetModuleHandleA,GetProcAddress,GetSystemFirmwareTable,GetSystemFirmwareTable,CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive0 16_2_0000012E17889FB0
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-30MA7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Users\user\AppData\Local\Temp\is-ATKLL.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIFBC3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\ti.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Users\user\AppData\Local\Temp\is-ATKLL.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-93C0J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\ilovepdf.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\sqlite.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\twlib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-UKPSI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-JDQA9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-VR0CA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\th.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\tt.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-CU1EC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\unins000.exe (copy) Jump to dropped file
Source: C:\Windows\Installer\MSIFBC3.tmp File created: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\Program Files (x86)\ilovepdf\is-8KFAQ.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIFBC3.tmp Jump to dropped file

Boot Survival:

barindex
Contains functionality to infect the boot sector
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetModuleHandleA,GetProcAddress,CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive0 13_2_04EC6740
Source: C:\Windows\System32\svchost.exe Code function: GetModuleHandleA,GetProcAddress,GetSystemFirmwareTable,GetSystemFirmwareTable,CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive0 16_2_0000012E17889FB0
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ilovepdf.lnk Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC3710 OpenSCManagerW,OpenServiceW,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle, 13_2_04EC3710

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_006A52B8 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow, 11_2_006A52B8
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_005C7E30 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow, 11_2_005C7E30
Contains functionality to clear windows event logs (to hide its activities)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBA010 ClearEventLogW,OpenEventLogA,ClearEventLogW,CloseEventLog, 13_2_04EBA010
Stores large binary data to the registry
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5HQ15BTC-BI2Q-S1J7-YRC6-SZJY3C3CP8J7}\650478DC7424C37C 1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\svchost.exe Registry key monitored for changes: HKEY_USERS.DEFAULT\Control Panel\International Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Windows\System32\svchost.exe System information queried: FirmwareTableInformation Jump to behavior
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetCommandLineW,GetModuleFileNameW,lstrcmpiW,StrStrIW,StrStrIW,CreateThread,CreateThread,CloseHandle,CloseHandle,CreateThread,CloseHandle,StrStrIW,CreateThread,WaitForSingleObject,CloseHandle,StrStrIW,Sleep,Sleep,CreateThread,WaitForSingleObject,CloseHandle,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 13_2_04ECC0A0
Source: C:\Windows\System32\svchost.exe Code function: GetCommandLineW,GetModuleFileNameW,lstrcmpiW,StrStrIW,CreateThread,CloseHandle,CreateThread,CloseHandle,StrStrIW,CreateThread,WaitForSingleObject,CloseHandle,StrStrIW,Sleep,CreateThread,WaitForSingleObject,CloseHandle,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle, 14_2_0000024B7D0EF5E0
Source: C:\Windows\System32\svchost.exe Code function: GetCommandLineW,GetModuleFileNameW,lstrcmpiW,StrStrIW,CreateThread,CloseHandle,CreateThread,CloseHandle,StrStrIW,CreateThread,WaitForSingleObject,CloseHandle,StrStrIW,Sleep,CreateThread,WaitForSingleObject,CloseHandle,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle, 16_2_0000012E1788F5E0
Source: C:\Windows\System32\svchost.exe Code function: GetCommandLineW,GetModuleFileNameW,lstrcmpiW,StrStrIW,CreateThread,CloseHandle,FindCloseChangeNotification,CreateThread,CloseHandle,StrStrIW,CreateThread,WaitForSingleObject,CloseHandle,StrStrIW,Sleep,CreateThread,WaitForSingleObject,CloseHandle,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle, 17_2_00000204F339F5E0
Contains functionality to detect sleep reduction / modifications
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB3C30 13_2_04EB3C30
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D4410 14_2_0000024B7D0D4410
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17874410 16_2_0000012E17874410
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384410 17_2_00000204F3384410
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 6684 Thread sleep count: 717 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6684 Thread sleep time: -71700s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6668 Thread sleep count: 1082 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6668 Thread sleep time: -14400000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe Last function: Thread delayed
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC5C60 GetModuleFileNameW,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,FindCloseChangeNotification, 13_2_04EC5C60
Contains functionality to enumerate running services
Source: C:\Windows\SysWOW64\rundll32.exe Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,CloseServiceHandle,OpenServiceW,QueryServiceConfigW,StrStrIW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 13_2_04ECB9A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,OpenServiceW,QueryServiceConfigW,QueryServiceConfig2W,CloseServiceHandle,wsprintfW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalSize,LocalReAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalReAlloc,LocalFree,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 13_2_04EC2F70
Source: C:\Windows\SysWOW64\rundll32.exe Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,CloseServiceHandle,Sleep,LocalAlloc,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,StartServiceW,CloseServiceHandle,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 13_2_04ECB800
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 14_2_0000024B7D0EEE50
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,LocalAlloc,LocalAlloc,OpenServiceW,QueryServiceConfigW,QueryServiceConfig2W,CloseServiceHandle,wsprintfW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalSize,LocalReAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalReAlloc,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 14_2_0000024B7D0E6010
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,StartServiceW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 14_2_0000024B7D0EEC00
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,LocalAlloc,LocalAlloc,OpenServiceW,QueryServiceConfigW,QueryServiceConfig2W,CloseServiceHandle,wsprintfW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalSize,LocalReAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalReAlloc,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 16_2_0000012E17886010
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 16_2_0000012E1788EE50
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,StartServiceW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 16_2_0000012E1788EC00
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,StartServiceW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 17_2_00000204F339EC00
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,LocalAlloc,LocalAlloc,OpenServiceW,QueryServiceConfigW,QueryServiceConfig2W,CloseServiceHandle,wsprintfW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,ExpandEnvironmentStringsW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalSize,LocalReAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalReAlloc,LocalFree,LocalFree,LocalFree,CloseServiceHandle, 17_2_00000204F3396010
Source: C:\Windows\System32\svchost.exe Code function: OpenSCManagerW,EnumServicesStatusExW,CloseServiceHandle,LocalAlloc,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,LocalFree,LocalAlloc,OpenServiceW,QueryServiceConfigW,StrStrIW,CloseServiceHandle,LocalFree,LocalFree,CloseServiceHandle, 17_2_00000204F339EE50
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\svchost.exe Thread delayed: delay time: 3600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\svchost.exe Window / User API: threadDelayed 717 Jump to behavior
Source: C:\Windows\System32\svchost.exe Window / User API: threadDelayed 1082 Jump to behavior
May check if the current machine is a sandbox (GetTickCount - Sleep)
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384410 17_2_00000204F3384410
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB3C30 13_2_04EB3C30
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-30MA7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ATKLL.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\ti.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ATKLL.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-93C0J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\ilovepdf.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\twlib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-UKPSI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-JDQA9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\tt.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\th.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-VR0CA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-CU1EC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Dropped PE file which has not been started: C:\Program Files (x86)\ilovepdf\is-8KFAQ.tmp Jump to dropped file
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Windows\System32\svchost.exe Thread delayed: delay time: 3600000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC4560 lstrlenW,GetProcessImageFileNameW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,QueryDosDeviceW,QueryDosDeviceW,GetLastError,QueryDosDeviceW,lstrlenW,wsprintfW, 13_2_04EC4560
Source: svchost.exe, 0000001E.00000000.384529997.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: "@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000.ifo
Source: svchost.exe, 0000001E.00000000.384529997.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a0c91efb8b}#{6ead3d82-25ec-46bc-b7fd-c1f0df8f5037}
Source: svchost.exe, 00000026.00000002.827434902.0000025C96535000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWe>%SystemRoot%\system32\mswsock.dll<IdleSettings>
Source: svchost.exe, 00000010.00000003.500955879.0000012E19682000.00000004.00000001.sdmp Binary or memory string: VMware, Inc.
Source: svchost.exe, 0000001E.00000000.384529997.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a0c91efb8b}
Source: svchost.exe, 00000010.00000002.816396441.0000012E176C2000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWMSAFD Irda [IrDA]OleMainThreadWndClass
Source: svchost.exe, 00000010.00000003.422971039.0000012E176AF000.00000004.00000001.sdmp, svchost.exe, 00000011.00000000.333907246.00000204F304E000.00000004.00000001.sdmp, svchost.exe, 00000014.00000000.341000431.000001D91A429000.00000004.00000001.sdmp, svchost.exe, 00000018.00000000.359760415.000001DC51288000.00000004.00000001.sdmp, svchost.exe, 00000025.00000003.533385222.000001AFB9A82000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000026.00000000.409171798.0000025C96594000.00000004.00000001.sdmp Binary or memory string: VMware, Inc.ed
Source: svchost.exe, 0000001E.00000000.383086421.000001BE5C029000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: svchost.exe, 00000015.00000002.812290749.000002F2C5013000.00000004.00000001.sdmp Binary or memory string: Allow inbound TCP port 636 traffic for vmicheartbeat
Source: svchost.exe, 0000001E.00000002.816717606.000001BE5C115000.00000004.00000001.sdmp Binary or memory string: nonic\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}DeviceArrivalPU
Source: svchost.exe, 0000001E.00000002.807078645.000000220DAFA000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000001e9-90ce-806e6f6e6963}\
Source: svchost.exe, 0000001E.00000000.383055676.000001BE5C013000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}d
Source: svchost.exe, 0000001E.00000000.383086421.000001BE5C029000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: svchost.exe, 0000001E.00000000.384529997.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 0000000D.00000002.415655644.000000000339A000.00000004.00000020.sdmp, svchost.exe, 0000000E.00000002.812356243.0000024B7CA36000.00000004.00000001.sdmp, svchost.exe, 00000013.00000000.337659687.000002334203F000.00000004.00000001.sdmp, svchost.exe, 00000015.00000000.344287290.000002F2C5029000.00000004.00000001.sdmp, svchost.exe, 00000016.00000000.348368674.00000222CA43F000.00000004.00000001.sdmp, svchost.exe, 00000017.00000002.813571849.0000028621678000.00000004.00000001.sdmp, svchost.exe, 00000019.00000000.364042683.000002216AA5A000.00000004.00000001.sdmp, svchost.exe, 0000001B.00000002.816000256.000002743903C000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000000.376788702.000001111A236000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000000.380313179.0000022F11A29000.00000004.00000001.sdmp, svchost.exe, 0000001E.00000000.384529997.000001BE5C03F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.810844808.0000021C22429000.00000004.00000001.sdmp, svchost.exe, 00000022.00000003.572028015.00000202B1ABD000.00000004.00000001.sdmp, svchost.exe, 00000025.00000000.401740945.000001AFB9AA4000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000026.00000000.409171798.0000025C96594000.00000004.00000001.sdmp Binary or memory string: VMware7,1L
Source: svchost.exe, 0000001B.00000000.366941643.0000027439029000.00000004.00000001.sdmp Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
Source: svchost.exe, 0000001E.00000002.815535312.000001BE5C07A000.00000004.00000001.sdmp Binary or memory string: l\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}22\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: svchost.exe, 00000010.00000003.682254804.0000012E19614000.00000004.00000001.sdmp Binary or memory string: (5>OVMware, Inc.VMware Virtual disk 2.0 E4F221468}
Source: svchost.exe, 00000026.00000000.407855374.0000025C95C8A000.00000004.00000001.sdmp Binary or memory string: VMware820ES
Source: svchost.exe, 0000001E.00000000.383103726.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000011.00000000.331175005.00000204F3067000.00000004.00000001.sdmp Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 0000001E.00000000.383055676.000001BE5C013000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001E.00000000.383103726.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000010.00000003.422971039.0000012E176AF000.00000004.00000001.sdmp Binary or memory string: (5>OVMware, Inc.VMware Virtual disk 2.0
Source: svchost.exe, 0000001E.00000000.383055676.000001BE5C013000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001E.00000000.383103726.000001BE5C03F000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{7fccc86c-228a-40ad-8a58-f590af7bfdce}b}}
Source: svchost.exe, 00000026.00000000.407855374.0000025C95C8A000.00000004.00000001.sdmp Binary or memory string: VMware8
Source: svchost.exe, 0000001E.00000002.815535312.000001BE5C07A000.00000004.00000001.sdmp Binary or memory string: AASCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000&00A8
Source: svchost.exe, 00000010.00000003.422971039.0000012E176AF000.00000004.00000001.sdmp Binary or memory string: VMware
Source: svchost.exe, 00000011.00000000.329876741.00000204EFA29000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW}
Source: svchost.exe, 00000010.00000002.812470084.0000012E17623000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW@
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004AF91C GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery, 10_2_004AF91C
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0040AEF4 FindFirstFileW,FindClose, 10_2_0040AEF4
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 10_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0040E6A0 FindFirstFileW,FindClose, 11_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0060BC10 FindFirstFileW,GetLastError, 11_2_0060BC10
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW, 11_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_006B76A0 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose, 11_2_006B76A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB4C20 wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 13_2_04EB4C20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB56D0 FindFirstFileW,FindClose, 13_2_04EB56D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB4E30 wsprintfW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 13_2_04EB4E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB57F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 13_2_04EB57F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EE97D9 FindFirstFileExA, 13_2_04EE97D9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB42B0 LocalAlloc,wsprintfW,FindFirstFileW,_wcsstr,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 13_2_04EB42B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB6A30 lstrcatW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 13_2_04EB6A30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EB53D0 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,std::_Xinvalid_argument, 13_2_04EB53D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC7390 lstrcpyW,lstrcatW,lstrcatW,CreateDirectoryW,GetLastError,GetLastError,FindFirstFileW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 13_2_04EC7390
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D5E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 14_2_0000024B7D0D5E30
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EAE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 14_2_0000024B7D0EAE60
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D57B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 14_2_0000024B7D0D57B0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D49FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 14_2_0000024B7D0D49FF
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D7A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 14_2_0000024B7D0D7A20
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D4AE3 FindFirstFileW,FindClose, 14_2_0000024B7D0D4AE3
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D63F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 14_2_0000024B7D0D63F0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D110478 FindFirstFileExA, 14_2_0000024B7D110478
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0D4B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 14_2_0000024B7D0D4B90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17874AE3 FindFirstFileW,FindClose, 16_2_0000012E17874AE3
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178749FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 16_2_0000012E178749FF
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17877A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 16_2_0000012E17877A20
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178757B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 16_2_0000012E178757B0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17875E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 16_2_0000012E17875E30
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788AE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 16_2_0000012E1788AE60
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178B0478 FindFirstFileExA, 16_2_0000012E178B0478
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178763F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 16_2_0000012E178763F0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17874B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 16_2_0000012E17874B90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19805CF4 FindFirstFileExA, 16_2_0000012E19805CF4
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19823D90 FindFirstFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 16_2_0000012E19823D90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198EB2F0 FindFirstFileW,FreeEnvironmentStringsW,GetCommandLineA, 16_2_0000012E198EB2F0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384B90 LocalAlloc,wsprintfW,FindFirstFileW,LocalReAlloc,wsprintfW,lstrlenW,wsprintfW,FindNextFileW,LocalFree,FindClose, 17_2_00000204F3384B90
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33863F0 FindFirstFileW,FindClose,CreateFileW,CloseHandle, 17_2_00000204F33863F0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33C0478 FindFirstFileExA, 17_2_00000204F33C0478
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3384AE3 FindFirstFileW,FindClose, 17_2_00000204F3384AE3
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33849FF wsprintfW,FindFirstFileW,LocalAlloc,LocalReAlloc,lstrlenW,FindNextFileW,LocalFree,FindClose, 17_2_00000204F33849FF
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3387A20 GetEnvironmentVariableW,LoadLibraryA,GetProcAddress,GetUserProfileDirectoryW,CloseHandle,lstrcatW,wsprintfW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,PathFileExistsW,FindNextFileW,wsprintfW,FindClose,wsprintfW, 17_2_00000204F3387A20
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33857B0 wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 17_2_00000204F33857B0
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F3385E30 lstrlenW,wsprintfW,FindFirstFileW,wsprintfW,wsprintfW,FindNextFileW,FindClose,lstrlenW, 17_2_00000204F3385E30
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339AE60 lstrcpyW,lstrcatW,CreateDirectoryW,GetLastError,FindFirstFileW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrcmpW,CreateDirectoryW,GetLastError,CopyFileW,FindNextFileW, 17_2_00000204F339AE60
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC5C60 GetModuleFileNameW,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,FindCloseChangeNotification, 13_2_04EC5C60
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC8FD0 CloseServiceHandle,LoadLibraryA,LoadLibraryA,GetProcAddress,RtlAdjustPrivilege,OpenProcess,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,FindCloseChangeNotification,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 13_2_04EC8FD0
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EDEFAF mov eax, dword ptr fs:[00000030h] 13_2_04EDEFAF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04D772D8 mov eax, dword ptr fs:[00000030h] 13_2_04D772D8
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED669F IsDebuggerPresent,OutputDebugStringW, 13_2_04ED669F
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FB804 GetLastError,IsDebuggerPresent,OutputDebugStringW, 14_2_0000024B7D0FB804
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EBB540 UnmapViewOfFile,CreateFileMappingW,MapViewOfFile,GetProcessHeap,HeapFree, 13_2_04EBB540
Enables debug privileges
Source: C:\Windows\System32\svchost.exe Process token adjusted: Debug Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC1D00 SetEvent,InterlockedExchange,BlockInput,BlockInput,BlockInput, 13_2_04EC1D00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EDE94C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_04EDE94C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED5AE6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_04ED5AE6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED62AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_04ED62AE
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D103EBC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_0000024B7D103EBC
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FA9E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 14_2_0000024B7D0FA9E0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0FB324 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 14_2_0000024B7D0FB324
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789B324 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000012E1789B324
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1789A9E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 16_2_0000012E1789A9E0
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E178A3EBC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000012E178A3EBC
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1980296C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000012E1980296C
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E19805788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000012E19805788
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198EB3D8 SetUnhandledExceptionFilter, 16_2_0000012E198EB3D8
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D3648 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_0000012E198D3648
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198D0824 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 16_2_0000012E198D0824
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33AB324 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_00000204F33AB324
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33B3EBC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_00000204F33B3EBC

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\svchost.exe Domain query: toa.mygametoa.com
Allocates memory in foreign processes
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 24B7C9A0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 204F32C0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 23341FB0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1D91A370000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2F2C5B40000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 222CAA60000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 286215B0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1DC519A0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2216B180000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 2743A260000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1111A940000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 22F12130000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1BE5BFA0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 21C22B30000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 202B2180000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 1AFBA0B0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\System32\svchost.exe base: 25C96320000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC98E0 GetVersionExW,GetProcAddress,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetSystemDirectoryW,wsprintfW,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,Sleep,GetCurrentProcess,OpenProcessToken,DuplicateTokenEx,SetTokenInformation,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CreateProcessAsUserW,CloseHandle,CreateProcessW,LoadLibraryA,GetProcAddress,CloseHandle,GetThreadContext,VirtualAllocEx,TerminateProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,WaitForSingleObject,CloseHandle,WaitForSingleObject,OpenThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,WaitForSingleObject,CloseHandle, 13_2_04EC98E0
Creates a thread in another existing process (thread injection)
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 7C9A0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: F32C0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 41FB0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 1A370000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: C5B40000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: CAA60000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 215B0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 519A0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 6B180000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 3A260000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 1A940000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 12130000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 5BFA0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 22B30000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: B2180000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: BA0B0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: C:\Windows\System32\svchost.exe EIP: 96320000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: unknown EIP: 3F100000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: unknown EIP: 8E740000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread created: unknown EIP: CCE40000 Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 24B7C9A0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 204F32C0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 23341FB0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 1D91A370000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 2F2C5B40000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 222CAA60000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 286215B0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 1DC519A0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 2216B180000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 2743A260000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 1111A940000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 22F12130000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 1BE5BFA0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 21C22B30000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 202B2180000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 1AFBA0B0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\System32\svchost.exe base: 25C96320000 Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\System32\svchost.exe Thread register set: target process: 6944 Jump to behavior
Contains functionality to inject threads in other processes
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC8FD0 CloseServiceHandle,LoadLibraryA,LoadLibraryA,GetProcAddress,RtlAdjustPrivilege,OpenProcess,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,FindCloseChangeNotification,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 13_2_04EC8FD0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0EBC10 LoadLibraryA,GetProcAddress,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 14_2_0000024B7D0EBC10
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E1788BC10 LoadLibraryA,GetProcAddress,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 16_2_0000012E1788BC10
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F339BC10 LoadLibraryA,GetProcAddress,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,WaitForSingleObject,CloseHandle,VirtualFreeEx,CloseHandle, 17_2_00000204F339BC10
Sets debug register (to hijack the execution of another thread)
Source: C:\Windows\System32\svchost.exe Thread register set: 6944 4D000 Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Windows\System32\svchost.exe Code function: GetVersionExW,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetSystemDirectoryW,wsprintfW,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,Sleep,CreateProcessAsUserW,CloseHandle,CreateProcessW,LoadLibraryA,GetProcAddress,CloseHandle,GetThreadContext,VirtualAllocEx,TerminateProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,FindCloseChangeNotification,OpenThread,WaitForSingleObject,GetExitCodeThread,SetConsoleCtrlHandler,CloseHandle,CloseHandle,FindCloseChangeNotification,WaitForSingleObject,Sleep,WaitForSingleObject,CloseHandle,SetConsoleCtrlHandler,OpenThread,WaitForSingleObject,SetConsoleCtrlHandler, %ssvchost.exe -k SystemNetworkService 14_2_0000024B7D0EC6B0
Source: C:\Windows\System32\svchost.exe Code function: GetVersionExW,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetSystemDirectoryW,wsprintfW,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,Sleep,CreateProcessAsUserW,CloseHandle,CreateProcessW,LoadLibraryA,GetProcAddress,CloseHandle,GetThreadContext,VirtualAllocEx,TerminateProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,OpenThread,WaitForSingleObject,GetExitCodeThread,SetConsoleCtrlHandler,CloseHandle,CloseHandle,WaitForSingleObject,Sleep,WaitForSingleObject,CloseHandle,SetConsoleCtrlHandler,OpenThread,WaitForSingleObject,SetConsoleCtrlHandler, %ssvchost.exe -k SystemNetworkService 16_2_0000012E1788C6B0
Source: C:\Windows\System32\svchost.exe Code function: GetVersionExW,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetSystemDirectoryW,wsprintfW,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,Sleep,CreateProcessAsUserW,CloseHandle,CreateProcessW,LoadLibraryA,GetProcAddress,CloseHandle,GetThreadContext,VirtualAllocEx,TerminateProcess,WriteProcessMemory,SetThreadContext,ResumeThread,CloseHandle,OpenThread,WaitForSingleObject,GetExitCodeThread,SetConsoleCtrlHandler,CloseHandle,CloseHandle,WaitForSingleObject,Sleep,WaitForSingleObject,CloseHandle,SetConsoleCtrlHandler,OpenThread,WaitForSingleObject,SetConsoleCtrlHandler, %ssvchost.exe -k SystemNetworkService 17_2_00000204F339C6B0
Contains functionality to simulate keystroke presses
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC2050 mouse_event,MapVirtualKeyW,mouse_event,SetCursorPos,mouse_event,WindowFromPoint,SetCapture,mouse_event,MapVirtualKeyW,keybd_event,mouse_event,mouse_event,mouse_event,MapVirtualKeyW, 13_2_04EC2050
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k SystemNetworkService Jump to behavior
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_006A4AF0 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle, 11_2_006A4AF0
Contains functionality to simulate mouse events
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04EC2050 mouse_event,MapVirtualKeyW,mouse_event,SetCursorPos,mouse_event,WindowFromPoint,SetCapture,mouse_event,MapVirtualKeyW,keybd_event,mouse_event,mouse_event,mouse_event,MapVirtualKeyW, 13_2_04EC2050
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_005C6A5C AllocateAndInitializeSid,GetVersion,GetModuleHandleW,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid, 11_2_005C6A5C
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_005C78B8 InitializeSecurityDescriptor,SetSecurityDescriptorDacl, 11_2_005C78B8
Source: svchost.exe, 00000010.00000002.826427875.0000012E17C80000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: svchost.exe, 00000010.00000002.826427875.0000012E17C80000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000010.00000002.826427875.0000012E17C80000.00000002.00020000.sdmp Binary or memory string: Progman
Source: svchost.exe, 00000010.00000002.826427875.0000012E17C80000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 10_2_0040B044
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: GetLocaleInfoW, 10_2_0041E034
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: GetLocaleInfoW, 10_2_0041E080
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: GetLocaleInfoW, 10_2_004AF218
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 10_2_0040A4CC
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: GetUserDefaultUILanguage,GetLocaleInfoW, 11_2_0040E7F0
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 11_2_0040DC78
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: GetLocaleInfoW, 11_2_0060FD58
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_00405AE0 cpuid 10_2_00405AE0
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_0041C3D8 GetLocalTime, 10_2_0041C3D8
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E198DEC74 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 16_2_0000012E198DEC74
Source: C:\Users\user\AppData\Local\Temp\is-OOL1B.tmp\MSIFBC3.tmp Code function: 11_2_00625580 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle, 11_2_00625580
Source: C:\Windows\Installer\MSIFBC3.tmp Code function: 10_2_004B5114 GetModuleHandleW,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy, 10_2_004B5114

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 00000026.00000000.409083058.0000025C96554000.00000004.00000001.sdmp Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe

Stealing of Sensitive Information:

barindex
Yara detected Cookie Stealer
Source: Yara match File source: 16.2.svchost.exe.12e19820000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.svchost.exe.12e19820000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.414330253.0000012E1A130000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost.exe PID: 6944, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\System32\svchost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies.tmp Jump to behavior
Source: C:\Windows\System32\svchost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp Jump to behavior
Source: C:\Windows\System32\svchost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\System32\svchost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Contains functionality to steal Chrome passwords or cookies
Source: C:\Windows\System32\svchost.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 16_2_0000012E19821D50
Source: C:\Windows\System32\svchost.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 16_2_0000012E19821D97

Remote Access Functionality:

barindex
Yara detected Cookie Stealer
Source: Yara match File source: 16.2.svchost.exe.12e19820000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.svchost.exe.12e19820000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.829801216.0000012E19820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000003.414330253.0000012E1A130000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost.exe PID: 6944, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ECD7B0 htons,bind,bind,InterlockedIncrement,InterlockedIncrement,InterlockedIncrement, 13_2_04ECD7B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED2030 socket,bind,closesocket,WSAGetLastError,SetLastError,closesocket,WSAGetLastError,SetLastError, 13_2_04ED2030
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_04ED39E0 WSAGetLastError,socket,WSAGetLastError,WSAIoctl,WSAGetLastError,htons,bind,WSAGetLastError, 13_2_04ED39E0
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F8000 WSAGetLastError,socket,htons,bind,WSAGetLastError, 14_2_0000024B7D0F8000
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F6260 socket,bind,WSAGetLastError,SetLastError,closesocket,WSAGetLastError,SetLastError, 14_2_0000024B7D0F6260
Source: C:\Windows\System32\svchost.exe Code function: 14_2_0000024B7D0F0B90 htons,bind, 14_2_0000024B7D0F0B90
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17896260 socket,bind,WSAGetLastError,SetLastError,closesocket,WSAGetLastError,SetLastError, 16_2_0000012E17896260
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17898000 WSAGetLastError,socket,htons,bind,WSAGetLastError, 16_2_0000012E17898000
Source: C:\Windows\System32\svchost.exe Code function: 16_2_0000012E17890B90 htons,bind, 16_2_0000012E17890B90
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A0B90 htons,bind, 17_2_00000204F33A0B90
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A6260 socket,bind,WSAGetLastError,SetLastError,closesocket,WSAGetLastError,SetLastError, 17_2_00000204F33A6260
Source: C:\Windows\System32\svchost.exe Code function: 17_2_00000204F33A8000 WSAGetLastError,socket,htons,bind,WSAGetLastError, 17_2_00000204F33A8000
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 508222 Sample: 6rfyiAq0nM Startdate: 24/10/2021 Architecture: WINDOWS Score: 74 61 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->61 63 Multi AV Scanner detection for domain / URL 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 3 other signatures 2->67 10 msiexec.exe 7 27 2->10         started        14 msiexec.exe 2 2->14         started        process3 file4 53 C:\Windows\Installer\MSIFBC3.tmp, PE32 10->53 dropped 89 Drops executables to the windows directory (C:\Windows) and starts them 10->89 16 MSIFBC3.tmp 2 10->16         started        signatures5 process6 file7 39 C:\Users\user\AppData\Local\...\MSIFBC3.tmp, PE32 16->39 dropped 19 MSIFBC3.tmp 25 32 16->19         started        process8 file9 41 C:\Program Files (x86)\...\is-VR0CA.tmp, PE32 19->41 dropped 43 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 19->43 dropped 45 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 19->45 dropped 47 13 other files (none is malicious) 19->47 dropped 22 rundll32.exe 3 19->22         started        process10 signatures11 73 Contains functionality to infect the boot sector 22->73 75 Contains functionality to inject threads in other processes 22->75 77 Contains functionality to inject code into remote processes 22->77 79 5 other signatures 22->79 25 svchost.exe 1 22->25 injected 28 svchost.exe 22->28 injected 30 svchost.exe 22->30 injected 32 14 other processes 22->32 process12 signatures13 81 System process connects to network (likely due to code injection or exploit) 25->81 83 Contains functionality to infect the boot sector 25->83 85 Contains functionality to inject threads in other processes 25->85 87 5 other signatures 25->87 34 svchost.exe 6 14 25->34         started        process14 dnsIp15 55 toa.mygametoa.com 34.64.183.91 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 34->55 57 208.95.112.1 TUT-ASUS United States 34->57 59 3 other IPs or domains 34->59 49 C:\Users\user\AppData\...\Login Data.tmp, SQLite 34->49 dropped 51 C:\Users\user\AppData\Local\...\Cookies.tmp, SQLite 34->51 dropped 69 Query firmware table information (likely to detect VMs) 34->69 71 Tries to harvest and steal browser information (history, passwords, etc) 34->71 file16 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 unknown United States
53334 TUT-ASUS false
172.67.167.122
 unknown United States
13335 CLOUDFLARENETUS false
34.64.183.91
 toa.mygametoa.com United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG true
104.21.75.46
 unknown United States
13335 CLOUDFLARENETUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
toa.mygametoa.com 34.64.183.91 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://fg.mygameagend.com/report7.4.php true
  • 6%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://bh.mygameadmin.com/report7.4.php false
  • Avira URL Cloud: safe
 unknown