Source: |
Binary string: $$.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: RegSvcs.pdbr source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: HP<o0C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdbMZ source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: wntdll.pdbUGP source: rRFQ_025261-97382.exe, 00000000.00000003.1428051889.0000000004080000.00000004.00001000.00020000.00000000.sdmp, rRFQ_025261-97382.exe, 00000000.00000003.1422045873.00000000041F0000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: rRFQ_025261-97382.exe, 00000000.00000003.1428051889.0000000004080000.00000004.00001000.00020000.00000000.sdmp, rRFQ_025261-97382.exe, 00000000.00000003.1422045873.00000000041F0000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdb8S source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Configuration.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: C:\Windows\RegSvcs.pdbpdbvcs.pdbG source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: RegSvcs.pdb66|I(L source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: RegSvcs.pdbegSvcs.pdbpdbvcs.pdbv4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: ?HoC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbt source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdbRSDS# source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: Microsoft.VisualBasic.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Windows.Forms.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb2 source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb| source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.pdbMZ source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.pdbp source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: @Ho.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdbRSDScUN source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_0027DBBE |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0024C2A2 FindFirstFileExW, |
0_2_0024C2A2 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002868EE FindFirstFileW,FindClose, |
0_2_002868EE |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0028698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
0_2_0028698F |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0027D076 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0027D3A9 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00289642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00289642 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0028979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0028979D |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00289B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
0_2_00289B2B |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00285C97 FindFirstFileW,FindNextFileW,FindClose, |
0_2_00285C97 |
Source: RegSvcs.exe, 00000002.00000002.1561069450.0000000002C05000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.com |
Source: RegSvcs.exe, 00000002.00000002.1561069450.0000000002C05000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.1561069450.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org |
Source: RegSvcs.exe, 00000002.00000002.1561069450.0000000002B41000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org/ |
Source: rRFQ_025261-97382.exe, 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://checkip.dyndns.org/q |
Source: RegSvcs.exe, 00000002.00000002.1561069450.0000000002B41000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Amcache.hve.5.dr |
String found in binary or memory: http://upx.sf.net |
Source: rRFQ_025261-97382.exe, 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://reallyfreegeoip.org/xml/ |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002A9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_002A9576 |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: Process Memory Space: rRFQ_025261-97382.exe PID: 6052, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: Process Memory Space: rRFQ_025261-97382.exe PID: 6052, type: MEMORYSTR |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: Process Memory Space: RegSvcs.exe PID: 1612, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: Process Memory Space: RegSvcs.exe PID: 1612, type: MEMORYSTR |
Matched rule: Detects Snake Keylogger Author: ditekSHen |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0021BF40 |
0_2_0021BF40 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00218060 |
0_2_00218060 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00282046 |
0_2_00282046 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00278298 |
0_2_00278298 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0024E4FF |
0_2_0024E4FF |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0024676B |
0_2_0024676B |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002A4873 |
0_2_002A4873 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0023CAA0 |
0_2_0023CAA0 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0021CAF0 |
0_2_0021CAF0 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0022CC39 |
0_2_0022CC39 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00246DD9 |
0_2_00246DD9 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0022B119 |
0_2_0022B119 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002191C0 |
0_2_002191C0 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00231394 |
0_2_00231394 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00231706 |
0_2_00231706 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0023781B |
0_2_0023781B |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00217920 |
0_2_00217920 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0022997D |
0_2_0022997D |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002319B0 |
0_2_002319B0 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00237A4A |
0_2_00237A4A |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00231C77 |
0_2_00231C77 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00237CA7 |
0_2_00237CA7 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0029BE44 |
0_2_0029BE44 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00249EEE |
0_2_00249EEE |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00231F32 |
0_2_00231F32 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_01183578 |
2_2_01183578 |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 0.2.rRFQ_025261-97382.exe.4020000.1.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000002.00000002.1560230703.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 00000000.00000002.1431825034.0000000004020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: Process Memory Space: rRFQ_025261-97382.exe PID: 6052, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: rRFQ_025261-97382.exe PID: 6052, type: MEMORYSTR |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: Process Memory Space: RegSvcs.exe PID: 1612, type: MEMORYSTR |
Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: RegSvcs.exe PID: 1612, type: MEMORYSTR |
Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger |
Source: |
Binary string: $$.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: RegSvcs.pdbr source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: HP<o0C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdbMZ source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: wntdll.pdbUGP source: rRFQ_025261-97382.exe, 00000000.00000003.1428051889.0000000004080000.00000004.00001000.00020000.00000000.sdmp, rRFQ_025261-97382.exe, 00000000.00000003.1422045873.00000000041F0000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: rRFQ_025261-97382.exe, 00000000.00000003.1428051889.0000000004080000.00000004.00001000.00020000.00000000.sdmp, rRFQ_025261-97382.exe, 00000000.00000003.1422045873.00000000041F0000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdb8S source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Configuration.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: C:\Windows\RegSvcs.pdbpdbvcs.pdbG source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: RegSvcs.pdb66|I(L source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: RegSvcs.pdbegSvcs.pdbpdbvcs.pdbv4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: ?HoC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbt source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Xml.ni.pdbRSDS# source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: Microsoft.VisualBasic.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Windows.Forms.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\mscorlib.pdb2 source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: mscorlib.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDB source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F99000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Windows.Forms.pdb| source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.pdbMZ source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: \??\C:\Windows\exe\RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.pdbp source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: @Ho.pdb source: RegSvcs.exe, 00000002.00000002.1560291731.0000000000997000.00000004.00000010.00020000.00000000.sdmp |
Source: |
Binary string: System.Configuration.ni.pdbRSDScUN source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.ni.pdb source: WERC640.tmp.dmp.5.dr |
Source: |
Binary string: System.Core.ni.pdbRSDS source: WERC640.tmp.dmp.5.dr |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0022F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_0022F98E |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002A1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
0_2_002A1C41 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_0027DBBE |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0024C2A2 FindFirstFileExW, |
0_2_0024C2A2 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_002868EE FindFirstFileW,FindClose, |
0_2_002868EE |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0028698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
0_2_0028698F |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0027D076 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0027D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0027D3A9 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00289642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00289642 |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_0028979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0028979D |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00289B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
0_2_00289B2B |
Source: C:\Users\user\Desktop\rRFQ_025261-97382.exe |
Code function: 0_2_00285C97 FindFirstFileW,FindNextFileW,FindClose, |
0_2_00285C97 |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: Amcache.hve.5.dr |
Binary or memory string: vmci.syshbin |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67 |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware, Inc. |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.5.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.5.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.5.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.5.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.5.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.5.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.5.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: RegSvcs.exe, 00000002.00000002.1560548128.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: Amcache.hve.5.dr |
Binary or memory string: vmci.sys |
Source: Amcache.hve.5.dr |
Binary or memory string: vmci.syshbin` |
Source: Amcache.hve.5.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: Amcache.hve.5.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.5.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.5.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: Amcache.hve.5.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: Amcache.hve.5.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.5.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.5.dr |
Binary or memory string: VMware Virtual RAM |
Source: Amcache.hve.5.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.5.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |