Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C4696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_007C4696 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CC93C FindFirstFileW,FindClose, |
0_2_007CC93C |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_007CC9C7 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_007CF200 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_007CF35D |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_007CF65E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_007C3A2B |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_007C3D4E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_007CBF27 |
Source: RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
Source: RegSvcs.exe, 00000002.00000002.2582719649.00000000006C0000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06 |
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0# |
Source: RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://ip-api.com |
Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582719649.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://ip-api.com/line/?fields=hosting |
Source: RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0 |
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.sectigo.com0A |
Source: RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://us2.smtp.mailhostbox.com |
Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://sectigo.com/CPS0 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007ECDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_007ECDAC |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0076E800 |
0_2_0076E800 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0078DBB5 |
0_2_0078DBB5 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0076E060 |
0_2_0076E060 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007E804A |
0_2_007E804A |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00774140 |
0_2_00774140 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00782405 |
0_2_00782405 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00796522 |
0_2_00796522 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0079267E |
0_2_0079267E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007E0665 |
0_2_007E0665 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00776843 |
0_2_00776843 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0078283A |
0_2_0078283A |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007989DF |
0_2_007989DF |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00778A0E |
0_2_00778A0E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007E0AE2 |
0_2_007E0AE2 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00796A94 |
0_2_00796A94 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C8B13 |
0_2_007C8B13 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007BEB07 |
0_2_007BEB07 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0078CD61 |
0_2_0078CD61 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00797006 |
0_2_00797006 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0077710E |
0_2_0077710E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00773190 |
0_2_00773190 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00761287 |
0_2_00761287 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007833C7 |
0_2_007833C7 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0078F419 |
0_2_0078F419 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007816C4 |
0_2_007816C4 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00775680 |
0_2_00775680 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007878D3 |
0_2_007878D3 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007758C0 |
0_2_007758C0 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00781BB8 |
0_2_00781BB8 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00799D05 |
0_2_00799D05 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0076FE40 |
0_2_0076FE40 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_0078BFE6 |
0_2_0078BFE6 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00781FD0 |
0_2_00781FD0 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_00753630 |
0_2_00753630 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00A5D692 |
2_2_00A5D692 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00A54AF8 |
2_2_00A54AF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00A53EE0 |
2_2_00A53EE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00A54228 |
2_2_00A54228 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE2430 |
2_2_05CE2430 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE6250 |
2_2_05CE6250 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE5238 |
2_2_05CE5238 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CEBCC0 |
2_2_05CEBCC0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE79D8 |
2_2_05CE79D8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE0040 |
2_2_05CE0040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE0006 |
2_2_05CE0006 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE72F8 |
2_2_05CE72F8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05CE5958 |
2_2_05CE5958 |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, ZTFEpdjP8zw.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, WnRNxU.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 2njIk.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, I5ElxL.cs |
Cryptographic APIs: 'CreateDecryptor', 'TransformBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, QQSiOsa4hPS.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, FdHU4eb83Z7.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C4696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_007C4696 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CC93C FindFirstFileW,FindClose, |
0_2_007CC93C |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_007CC9C7 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_007CF200 |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_007CF35D |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_007CF65E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_007C3A2B |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007C3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_007C3D4E |
Source: C:\Users\user\Desktop\6bdudXAsQW.exe |
Code function: 0_2_007CBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_007CBF27 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99891 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99781 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99672 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99562 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99429 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99313 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99203 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99094 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98984 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98875 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98765 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98656 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98547 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98437 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98328 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98219 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98094 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97984 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97875 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97766 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97656 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97547 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97434 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97328 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97219 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97107 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96991 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation |
Jump to behavior |