Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E08F67 FindFirstFileExW,FindNextFileW,FindClose,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040BDAF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004011D9 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004093C1 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004145BC _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004097DC _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00414960 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00414CC7 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409E01 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00413F80 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose, |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/privacy_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/subscriber_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2863327466.000000001632F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2866748482.000000001C2DD000.00000002.00001000.00020000.00000000.sdmp, sqlx[1].dll.2.dr | String found in binary or memory: http://www.sqlite.org/copyright.html. |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: http://www.valvesoftware.com/legal.htm |
Source: RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42/ |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://95.217.245.42:9000 |
Source: RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/0ea2osoft |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/B |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/J |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/Z |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/freebl3.dll |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/freebl3.dllEdge |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/mozglue.dll |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/mozglue.dllEdge |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/mozglue.dllt |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/msvcp140.dll |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/msvcp140.dlldge |
Source: RegAsm.exe, 00000002.00000002.2862938128.000000000156D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/nss3.dll |
Source: RegAsm.exe, 00000002.00000002.2862938128.000000000156D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/nss3.dll))) |
Source: RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/nss3.dllD |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/nss3.dllft |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/r |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/softokn3.dll |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/softokn3.dlldge |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862938128.000000000156D000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/sqlx.dll |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll_7) |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllser |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllw= |
Source: RegAsm.exe, 00000002.00000002.2862953478.0000000001584000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000/z |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000056C000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:900090ea2le |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000606000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000acrosoft |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000056C000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000el |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000ing |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000l |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000056C000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://95.217.245.42:9000vcruntime140.dllUser |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://api.steampowered.com/ |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://community.akamai.steamstatic |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://community.akamai.steamstatic.com/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8ABA&a |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG& |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1 |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6 |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=roSu8uqw |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=_Vry |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=KyfgrihL0xta&l=e |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6& |
Source: RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016 |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0 |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://help.steampowered.com/en/ |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://recaptcha.net |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://s.ytimg.co |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/X |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/discussions/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169 |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/market/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/my/wishlist/ |
Source: file.exe, file.exe, 00000000.00000002.1607514385.0000000000E1D000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2862223964.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169 |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/badges |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/inventory/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/workshop/ |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/ |
Source: 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/about/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/explore/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/legal/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/mobile |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/news/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/points/shop/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/privacy_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/stats/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/steam_refunds/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/subscriber_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp, CGDGCFBA.2.dr | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: CGDGCFBA.2.dr | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp, CGDGCFBA.2.dr | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: CGDGCFBA.2.dr | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: RegAsm.exe, 00000002.00000002.2862223964.000000000052E000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe |
Source: file.exe, file.exe, 00000000.00000002.1607514385.0000000000E1D000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2862223964.0000000000400000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://t.me/r1g1o |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: BKKFHIEG.2.dr | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.google.com/recaptcha/ |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.gstatic.cn/recaptcha/ |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.gstatic.com/recaptcha/ |
Source: RegAsm.exe, 00000002.00000002.2862223964.0000000000435000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=T |
Source: RegAsm.exe, 00000002.00000002.2862775596.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.2.dr | String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback |
Source: RegAsm.exe, 00000002.00000002.2862662158.0000000001374000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://www.youtube.com/ |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E3B0B0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E394EB |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E03663 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E38A49 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E39BC7 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E0CD80 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00DFEEF0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00DFBE7D |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E38F9A |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E03F4F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041A609 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041B787 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041AB5A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041CC70 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A4CF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09292D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1F9CC0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C092AA9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0912A8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C091C9E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C145940 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C092018 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1B9A20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1F9430 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C139690 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C14D6D0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A9000 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1B5040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C26D209 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1253B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C093580 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0B8D2A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C091EF1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C194A60 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1D0480 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0B8680 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0B8763 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0F4760 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C128760 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1B8030 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C110090 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C118120 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C093AB2 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09290A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09251D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0BBAB0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09F160 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09174E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0C3370 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0919DD |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0D6E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C26AEBE |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0F2EE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1CE800 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C093E3B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09481D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1AA900 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C18A940 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1769C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09AA40 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09EA80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0947AF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0BA560 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C18A590 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A66C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C11A0B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C09209F |
Source: C:\Users\user\Desktop\file.exe | Section loaded: apphelp.dll |
Source: C:\Users\user\Desktop\file.exe | Section loaded: kernel.appcore.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: apphelp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: aclayers.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mpr.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sfc.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sfc_os.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sspicli.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wininet.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rstrtmgr.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ncrypt.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ntasn1.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dbghelp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: iertutil.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: windows.storage.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wldp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: profapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: kernel.appcore.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ondemandconnroutehelper.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: winhttp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mswsock.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: iphlpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: winnsi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: urlmon.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: srvcli.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: netutils.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dnsapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rasadhlp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: fwpuclnt.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: schannel.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mskeyprotect.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: msasn1.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cryptsp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rsaenh.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cryptbase.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: gpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ncryptsslp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cryptnet.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dhcpcsvc6.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dhcpcsvc.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: webio.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cabinet.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wbemcomn.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: amsi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: userenv.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: version.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: uxtheme.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sxs.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ntmarta.dll |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00E08F67 FindFirstFileExW,FindNextFileW,FindClose,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040BDAF _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004011D9 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004093C1 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004145BC _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004097DC _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00414960 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00414CC7 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409E01 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00413F80 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C10DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C111FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C135910 sqlite3_mprintf,sqlite3_bind_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1BD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C10DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1B14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1BD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1355B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C16D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C129090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1351D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C14D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C174D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0C0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0E8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0B8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0E06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C108200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0BB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C153770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C1737E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0EEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0A66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C10A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0FE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C10E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1C0FE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, |