Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 0_2_00452126 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, | 0_2_0045C999 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_00436ADE |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00434BEE |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, | 0_2_00436D2D |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00442E1F |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0045DD7C FindFirstFileW,FindClose, | 0_2_0045DD7C |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 0_2_0044BD29 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_00475FE5 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_0044BF8D |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen, | 3_2_00406EC3 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen, | 4_2_00408441 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00407E0E FindFirstFileW,FindNextFileW,FindClose, | 4_2_00407E0E |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp | String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp | String found in binary or memory: http://ocsp.comodoca.com0 |
Source: bhv61A5.tmp.4.dr | String found in binary or memory: http://ocsp.digicert.com0 |
Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://r11.i.lencr.org/0 |
Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://r11.o.lencr.org0# |
Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://whatismyipaddress.com |
Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://whatismyipaddress.com/ |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp | String found in binary or memory: http://whatismyipaddress.com/- |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.carterandcone.coml |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/? |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers8 |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designers? |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fontbureau.com/designersG |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.fonts.com |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/bThe |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.founder.com.cn/cn/cThe |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.galapagosdesign.com/DPlease |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm |
Source: RegSvcs.exe, 00000001.00000002.4165739878.0000000004F70000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm9 |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.goodfont.co.kr |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.jiyu-kobo.co.jp/ |
Source: vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: http://www.nirsoft.net/ |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sajatypeworks.com |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sakkal.com |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.sandoll.co.kr |
Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.site.com/logs.php |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.tiro.com |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.typography.netD |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.urwpp.deDPlease |
Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.zhongyicts.com.cn |
Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://x1.c.lencr.org/0 |
Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://x1.i.lencr.org/0 |
Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728 |
Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com: |
Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033 |
Source: vbc.exe, 00000004.00000002.1788187036.000000000060B000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv |
Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live |
Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=0000000048072BS |
Source: vbc.exe | String found in binary or memory: https://login.yahoo.com/config/login |
Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://whatismyipaddress.com |
Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://whatismyipaddress.com/ |
Source: vbc.exe | String found in binary or memory: https://www.google.com/accounts/servicelogin |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net> |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net> |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00409A40 | 0_2_00409A40 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00412038 | 0_2_00412038 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0047E1FA | 0_2_0047E1FA |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0041A46B | 0_2_0041A46B |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0041240C | 0_2_0041240C |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_004045E0 | 0_2_004045E0 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00412818 | 0_2_00412818 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0047CBF0 | 0_2_0047CBF0 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044EBBC | 0_2_0044EBBC |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00412C38 | 0_2_00412C38 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044ED9A | 0_2_0044ED9A |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00424F70 | 0_2_00424F70 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0041AF0D | 0_2_0041AF0D |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00427161 | 0_2_00427161 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_004212BE | 0_2_004212BE |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00443390 | 0_2_00443390 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00443391 | 0_2_00443391 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0041D750 | 0_2_0041D750 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_004037E0 | 0_2_004037E0 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00427859 | 0_2_00427859 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0040F890 | 0_2_0040F890 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0042397B | 0_2_0042397B |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00411B63 | 0_2_00411B63 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00423EBF | 0_2_00423EBF |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_04369B78 | 0_2_04369B78 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_00BB761B | 1_2_00BB761B |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A51DA8 | 1_2_04A51DA8 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A59790 | 1_2_04A59790 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A55C20 | 1_2_04A55C20 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A56048 | 1_2_04A56048 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A57088 | 1_2_04A57088 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A57E93 | 1_2_04A57E93 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A57098 | 1_2_04A57098 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A51D98 | 1_2_04A51D98 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A55C10 | 1_2_04A55C10 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Code function: 1_2_04A57EA0 | 1_2_04A57EA0 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00404DDB | 3_2_00404DDB |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_0040BD8A | 3_2_0040BD8A |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00404E4C | 3_2_00404E4C |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00404EBD | 3_2_00404EBD |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00404F4E | 3_2_00404F4E |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00404419 | 4_2_00404419 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00404516 | 4_2_00404516 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00413538 | 4_2_00413538 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_004145A1 | 4_2_004145A1 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_0040E639 | 4_2_0040E639 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_004337AF | 4_2_004337AF |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_004399B1 | 4_2_004399B1 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_0043DAE7 | 4_2_0043DAE7 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00405CF6 | 4_2_00405CF6 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00403F85 | 4_2_00403F85 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00411F99 | 4_2_00411F99 |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye |
Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence'; |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q); |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger'); |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0 |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s; |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s; |
Source: vbc.exe, 00000004.00000002.1788911203.00000000020A4000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key)); |
Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp | Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 0_2_00452126 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose, | 0_2_0045C999 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_00436ADE |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00434BEE |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle, | 0_2_00436D2D |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00442E1F |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0045DD7C FindFirstFileW,FindClose, | 0_2_0045DD7C |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 0_2_0044BD29 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_00475FE5 |
Source: C:\Users\user\Desktop\fAzUnj6Djg.exe | Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_0044BF8D |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 3_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen, | 3_2_00406EC3 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen, | 4_2_00408441 |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Code function: 4_2_00407E0E FindFirstFileW,FindNextFileW,FindClose, | 4_2_00407E0E |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe | Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation | Jump to behavior |