Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00145066 FindFirstFileExW, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, |
Source: RegAsm.exe, 00000002.00000002.2900507814.0000000001272000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en |
Source: RegAsm.exe, 00000002.00000002.2900507814.000000000121A000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabE |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/privacy_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: http://store.steampowered.com/subscriber_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2901515013.00000000134DC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2905345080.000000001947D000.00000002.00001000.00020000.00000000.sdmp, sqlx[1].dll.2.dr | String found in binary or memory: http://www.sqlite.org/copyright.html. |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: http://www.valvesoftware.com/legal.htm |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235/ahI |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000523000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000586000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000 |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/2b1cosoft |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/8 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/9 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/B |
Source: RegAsm.exe, 00000002.00000002.2900987028.00000000013F7000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/N |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/O |
Source: RegAsm.exe, 00000002.00000002.2900987028.00000000013F7000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/V |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/b |
Source: RegAsm.exe, 00000002.00000002.2900987028.00000000013F7000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/f |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/freebl3.dll |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/freebl3.dllEdge |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/mozglue.dll |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/mozglue.dll$ |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/mozglue.dllEdge |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2900806294.0000000001380000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/msvcp140.dll |
Source: RegAsm.exe, 00000002.00000002.2900806294.0000000001380000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/msvcp140.dllD |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/msvcp140.dllP |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/msvcp140.dlldge |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/nss3.dll |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/nss3.dll2 |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/nss3.dllft |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/soft |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/softokn3.dll |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/softokn3.dll2 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/softokn3.dllP |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/softokn3.dlldge |
Source: RegAsm.exe, 00000002.00000002.2900946263.00000000013E9000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/softokn3.dllf |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000561000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/sqlx.dll |
Source: RegAsm.exe, 00000002.00000002.2900987028.00000000013F7000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/v |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2900806294.000000000138F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dll |
Source: RegAsm.exe, 00000002.00000002.2900806294.000000000138F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dll. |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dllO |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dllUser |
Source: RegAsm.exe, 00000002.00000002.2900806294.000000000138F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dllc |
Source: RegAsm.exe, 00000002.00000002.2900806294.000000000138F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dllets |
Source: RegAsm.exe, 00000002.00000002.2900806294.000000000138F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000/vcruntime140.dllh |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000523000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:900062b1c |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000EB |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000ing |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://116.202.5.235:9000l |
Source: FHJEGI.2.dr | String found in binary or memory: https://ac.ecosia.org/autocomplete?q= |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg |
Source: FHJEGI.2.dr | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: FHJEGI.2.dr | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: FHJEGI.2.dr | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=5CgcHEsWGAFt&a |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG& |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=soQOTmUz |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=6MtR |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=L3Ed_Gybseku&l=e |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6& |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.s |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0 |
Source: FHJEGI.2.dr | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: FHJEGI.2.dr | String found in binary or memory: https://duckduckgo.com/chrome_newtab |
Source: FHJEGI.2.dr | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://help.steampowered.com/en/ |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts |
Source: RegAsm.exe, 00000002.00000002.2900507814.0000000001272000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/_ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/discussions/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199686524322 |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/market/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/my/wishlist/ |
Source: file.exe, 00000000.00000002.1645416850.0000000000158000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2900507814.0000000001272000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000400000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322 |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322/badges |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322/inventory/ |
Source: RegAsm.exe, 00000002.00000002.2900507814.0000000001272000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322C |
Source: RegAsm.exe, 00000002.00000002.2900507814.0000000001272000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322P |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://steamcommunity.com/workshop/ |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/ |
Source: 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/about/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/explore/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/legal/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/mobile |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/news/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/points/shop/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/privacy_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/stats/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/steam_refunds/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://store.steampowered.com/subscriber_agreement/ |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp, DHCFID.2.dr | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 |
Source: DHCFID.2.dr | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp, DHCFID.2.dr | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 |
Source: DHCFID.2.dr | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install |
Source: RegAsm.exe, 00000002.00000002.2899893197.00000000005A5000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t.me/ |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000523000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://t.me/k0mono |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t.me/k0monoHi |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000523000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: https://web.telegram.org |
Source: FHJEGI.2.dr | String found in binary or memory: https://www.ecosia.org/newtab/ |
Source: FHJEGI.2.dr | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico |
Source: RegAsm.exe, 00000002.00000002.2900666615.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2899893197.0000000000446000.00000040.00000400.00020000.00000000.sdmp, 76561199686524322[1].htm.2.dr | String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0014D4D0 |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_001442CF |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_0014771B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041C07A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041E190 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041BB29 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0041CCA7 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19244CF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192E5940 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19231C9E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19359A20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19232018 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923292D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19399CC0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192312A8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19232AA9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19249000 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19355040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192C53B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19233580 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1940D209 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19399430 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192D9690 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192ED6D0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19231EF1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19334A60 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19258D2A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192B8120 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19358030 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192B0090 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19233AB2 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19370480 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19258763 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19294760 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192C8760 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19258680 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923251D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1925BAB0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923290A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923174E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19263370 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1934A900 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1932A940 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_193169C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19233E3B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1936E800 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923481D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923AA40 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923EA80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192319DD |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19276E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19292EE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1940AEBE |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192BA0B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1923209F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1925A560 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1932A590 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192347AF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192466C0 |
Source: C:\Users\user\Desktop\file.exe | Section loaded: apphelp.dll |
Source: C:\Users\user\Desktop\file.exe | Section loaded: kernel.appcore.dll |
Source: C:\Users\user\Desktop\file.exe | Section loaded: cryptsp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: apphelp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: aclayers.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mpr.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sfc.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sfc_os.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sspicli.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wininet.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rstrtmgr.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ncrypt.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ntasn1.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dbghelp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: iertutil.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: windows.storage.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wldp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: profapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: kernel.appcore.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ondemandconnroutehelper.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: winhttp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mswsock.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: iphlpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: winnsi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: urlmon.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: srvcli.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: netutils.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dnsapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rasadhlp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: fwpuclnt.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: schannel.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: mskeyprotect.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: msasn1.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: dpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cryptsp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: rsaenh.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: cryptbase.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: gpapi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ncryptsslp.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: wbemcomn.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: amsi.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: userenv.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: version.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: uxtheme.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: sxs.dll |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Section loaded: ntmarta.dll |
Source: C:\Users\user\Desktop\file.exe | Code function: 0_2_00145066 FindFirstFileExW, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192D5910 sqlite3_mprintf,sqlite3_bind_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1935D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192ADB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19245C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192B1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192ADFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192D51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192C9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192ED3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192D55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1935D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_193514D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1930D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19244820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19314D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19260FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192A8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19288550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_19258680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192806E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1925B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192F3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_193137E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1928EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192AE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1929E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_1929E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192AA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value, |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Code function: 2_2_192466C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset, |