Windows Analysis Report
Ref#5010038.exe

Overview

General Information

Sample name: Ref#5010038.exe
Analysis ID: 1601231
MD5: cfcfe12e9d008183a9ab07c25d8bb0d9
SHA1: 9a4685717ef8485e57cc8b0639ee100cdd09cd4d
SHA256: f02f1ee4b884169c99d73ec240cbc150933f34e1da80be8d310de7b05d3693ee
Tags: exeuser-adrian__luca
Infos:

Detection

AgentTesla, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Yara detected XWorm
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Name Description Attribution Blogpost URLs Link
XWorm Malware with wide range of capabilities ranging from RAT to ransomware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

AV Detection

barindex
Source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["89.40.31.232"], "Aes key": "1717", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "162.254.34.31", "Username": "sendxambro@educt.shop", "Password": "ABwuRZS5Mjh5"}
Source: C:\Users\user\AppData\Local\Temp\refff.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\gtent.exe ReversingLabs: Detection: 36%
Source: Ref#5010038.exe ReversingLabs: Detection: 55%
Source: Ref#5010038.exe Virustotal: Detection: 58% Perma Link
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Users\user\AppData\Roaming\gtent.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\refff.exe Joe Sandbox ML: detected
Source: Ref#5010038.exe Joe Sandbox ML: detected
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String decryptor: 89.40.31.232
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String decryptor: 1717
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String decryptor: <Xwormmm>
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String decryptor: 28Nov2024
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String decryptor: USB.exe
Source: Ref#5010038.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: Ref#5010038.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1628175764.0000000007470000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.00000000042AF000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004440000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003863000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003881000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ((.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1628175764.0000000007470000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.00000000042AF000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004440000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003863000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003881000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb9 source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdbllUtil.pdbpdbtil.pdb.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\InstallUtil.pdbpdbtil.pdb* source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdb1 source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: HPpn8C:\Windows\InstallUtil.pdbVW source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbH source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\InstallUtil.pdbm source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\InstallUtil.pdb";7 source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdbT source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.PDB source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\InstallUtil.pdb> source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?|nC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: @|n.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior

Networking

barindex
Source: Network traffic Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.8:49712 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49712 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.8:49712 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.8:49712 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.8:49717 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49717 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.8:49717 -> 162.254.34.31:587
Source: Network traffic Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.8:49717 -> 162.254.34.31:587
Source: Malware configuration extractor URLs: 89.40.31.232
Source: Yara match File source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE
Source: global traffic TCP traffic: 192.168.2.8:49712 -> 162.254.34.31:587
Source: Joe Sandbox View IP Address: 194.15.112.248 194.15.112.248
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View ASN Name: VIVIDHOSTINGUS VIVIDHOSTINGUS
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: global traffic TCP traffic: 192.168.2.8:49712 -> 162.254.34.31:587
Source: global traffic HTTP traffic detected: GET /NYJA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /neRB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /NYJA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /neRB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /NYJA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /neRB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /NYJA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /neRB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: oshi.atConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: oshi.at
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://james.newtonking.com/projects/json
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Ref#5010038.exe, 00000001.00000002.1597457186.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1738852630.0000000003211000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1967348275.0000000002561000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1965684457.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002801000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2689096568.000000000242C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1961029555.0000000000162000.00000040.00000400.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.00000000046E5000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004321000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1961029555.0000000000162000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1967348275.0000000002561000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.00000000046E5000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004321000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2689096568.000000000242C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: InstallUtil.exe, 00000004.00000002.1967348275.0000000002561000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2689096568.000000000242C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: InstallUtil.exe, 00000004.00000002.1967348275.0000000002561000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2689096568.000000000242C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: refff.exe, 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Ref#5010038.exe, 00000001.00000002.1597457186.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1738852630.0000000003211000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1965684457.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002801000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oshi.at
Source: Ref#5010038.exe, 00000001.00000002.1597457186.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1965684457.00000000032F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oshi.at/NYJA
Source: refff.exe, 00000003.00000002.1738852630.0000000003211000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002801000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oshi.at/neRB
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1597457186.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1965684457.0000000003367000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Ref#5010038.exe, gtent.exe.1.dr, refff.exe.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49715 version: TLS 1.2

System Summary

barindex
Source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 6.2.gtent.exe.4336438.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.Ref#5010038.exe.4077dd8.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.InstallUtil.exe.160000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 6.2.gtent.exe.4336438.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069EF9D8 NtResumeThread, 6_2_069EF9D8
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069EF9D0 NtResumeThread, 6_2_069EF9D0
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_00E7318D 1_2_00E7318D
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_00E7F2A0 1_2_00E7F2A0
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D39FE8 1_2_05D39FE8
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D37108 1_2_05D37108
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D3B930 1_2_05D3B930
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D30DCF 1_2_05D30DCF
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D3A408 1_2_05D3A408
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D39FD8 1_2_05D39FD8
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D37769 1_2_05D37769
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D30718 1_2_05D30718
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D30708 1_2_05D30708
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D38610 1_2_05D38610
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D38601 1_2_05D38601
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D370F8 1_2_05D370F8
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D39B91 1_2_05D39B91
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D39BA0 1_2_05D39BA0
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D37B10 1_2_05D37B10
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D37B01 1_2_05D37B01
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D94CD0 1_2_05D94CD0
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D912C0 1_2_05D912C0
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D915E7 1_2_05D915E7
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D924C8 1_2_05D924C8
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_0723F690 1_2_0723F690
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_07220006 1_2_07220006
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_07220040 1_2_07220040
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_074EA450 1_2_074EA450
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_074EA441 1_2_074EA441
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_074ECC8A 1_2_074ECC8A
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_074ECC98 1_2_074ECC98
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_014DF2F0 3_2_014DF2F0
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_0774F710 3_2_0774F710
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_0774F438 3_2_0774F438
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_0774E3B8 3_2_0774E3B8
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_0774DE38 3_2_0774DE38
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_07730040 3_2_07730040
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_07730007 3_2_07730007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0090E500 4_2_0090E500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0090D988 4_2_0090D988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_0090A940 4_2_0090A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00904A90 4_2_00904A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00903E78 4_2_00903E78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_009010C0 4_2_009010C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_009041C0 4_2_009041C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00902164 4_2_00902164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF7DF0 4_2_05CF7DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF3100 4_2_05CF3100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CFB2A3 4_2_05CFB2A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF5640 4_2_05CF5640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF6668 4_2_05CF6668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CFC200 4_2_05CFC200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF5D5F 4_2_05CF5D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF0040 4_2_05CF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF240A 4_2_05CF240A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CFE418 4_2_05CFE418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF7710 4_2_05CF7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_05CF0023 4_2_05CF0023
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_014BF2A0 6_2_014BF2A0
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069E8CC8 6_2_069E8CC8
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069E8CC5 6_2_069E8CC5
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069EB0F7 6_2_069EB0F7
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069EB108 6_2_069EB108
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_0786F690 6_2_0786F690
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_07850007 6_2_07850007
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_07850040 6_2_07850040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 7_2_01251680 7_2_01251680
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_0269F2F0 13_2_0269F2F0
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_05AF4CD0 13_2_05AF4CD0
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_05AF12C0 13_2_05AF12C0
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_05AF15E7 13_2_05AF15E7
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_05AF24C8 13_2_05AF24C8
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FDF710 13_2_06FDF710
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FDF438 13_2_06FDF438
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FDDE38 13_2_06FDDE38
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FDE3B8 13_2_06FDE3B8
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FC0040 13_2_06FC0040
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FC0006 13_2_06FC0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008ED990 14_2_008ED990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008EA948 14_2_008EA948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008E4A98 14_2_008E4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008E3E80 14_2_008E3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008E41C8 14_2_008E41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_04F28DE0 14_2_04F28DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_04F2A048 14_2_04F2A048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_04F2BB58 14_2_04F2BB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C86660 14_2_05C86660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C85638 14_2_05C85638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C8C1F8 14_2_05C8C1F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C83100 14_2_05C83100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C8B29A 14_2_05C8B29A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C87DE8 14_2_05C87DE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C82409 14_2_05C82409
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C87708 14_2_05C87708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C80040 14_2_05C80040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C85D57 14_2_05C85D57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C80006 14_2_05C80006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 15_2_023F1680 15_2_023F1680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 908
Source: Ref#5010038.exe Static PE information: invalid certificate
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename6623bc4b-fa2b-443b-b079-7932cd528c3c.exe4 vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000000.1420878951.0000000000872000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamerefffff.exe, vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1596776459.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamerefffff.exe, vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamerefff.exe, vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1597457186.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1628175764.0000000007470000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref#5010038.exe
Source: Ref#5010038.exe, 00000001.00000002.1623477054.0000000006530000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameDxaoz.dll" vs Ref#5010038.exe
Source: Ref#5010038.exe Binary or memory string: OriginalFilenamerefffff.exe, vs Ref#5010038.exe
Source: Ref#5010038.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 6.2.gtent.exe.4336438.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.Ref#5010038.exe.4077dd8.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.InstallUtil.exe.160000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 6.2.gtent.exe.4336438.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Ref#5010038.exe, -.cs Cryptographic APIs: 'CreateDecryptor'
Source: Ref#5010038.exe, RijndaelHelper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Ref#5010038.exe, RijndaelHelper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Ref#5010038.exe, Qdthzacjty.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskFolder.cs Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, Task.cs Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskService.cs Task registration methods: 'CreateFromToken'
Source: Ref#5010038.exe, -.cs Base64 encoded string: 'VH8FPm9EKVQTLGZMZHIfJWQHRnUFL2dLa39NDW9dQmgCOHNodHUTJ2hFfj0RL352QXMaJkRIamNNJXp2TmgTO39Ia28CMzFOYnIpBm9HYHIecU1Mc1IPOm9vdWkbAmtHY2oTcW1Mc1k4K2dMPE8YLm9RSGBNGG9IY1UCOGNHYD03Lm4SYGMCFVpGdG8CI2VHPGETPlVqcnQEL2RdQ2kbK2NHPFUTPk5Ic2dNezwbPz9NC3laYmsUJnN6YnQAL3gSVG8bOmZMRnUFL2dLa38zMnpFaHQTODFLZmQTJnxEPHUbJWFMc2MFPg=='
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, User.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskSecurity.cs Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskFolder.cs Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, Task.cs Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: Ref#5010038.exe, -.cs Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, TaskPrincipal.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@17/5@3/4
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3020:64:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: \Sessions\1\BaseNamedObjects\qnzzEC3SI3U6Qmbo
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Local\Temp\refff.exe Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs"
Source: Ref#5010038.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Ref#5010038.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Ref#5010038.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Ref#5010038.exe ReversingLabs: Detection: 55%
Source: Ref#5010038.exe Virustotal: Detection: 58%
Source: Ref#5010038.exe String found in binary or memory: rebus-msg-id(rebus-return-address:rebus-original-return-address&rebus-error-message2rebus-time-to-be-received$rebus-source-queue$rebus-content-type
Source: C:\Users\user\Desktop\Ref#5010038.exe File read: C:\Users\user\Desktop\Ref#5010038.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Ref#5010038.exe "C:\Users\user\Desktop\Ref#5010038.exe"
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe"
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\gtent.exe "C:\Users\user\AppData\Roaming\gtent.exe"
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 908
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe"
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe" Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\gtent.exe "C:\Users\user\AppData\Roaming\gtent.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wtsapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winsta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\refff.exe Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\Ref#5010038.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Ref#5010038.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Ref#5010038.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1628175764.0000000007470000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.00000000042AF000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004440000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003863000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003881000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: ((.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Ref#5010038.exe, 00000001.00000002.1619952243.0000000003E9F000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1619952243.0000000003CB9000.00000004.00000800.00020000.00000000.sdmp, Ref#5010038.exe, 00000001.00000002.1628175764.0000000007470000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.00000000042AF000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004440000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003863000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2145112764.0000000003881000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb9 source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdbllUtil.pdbpdbtil.pdb.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256}Lq source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Windows\InstallUtil.pdbpdbtil.pdb* source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdb1 source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Ref#5010038.exe, 00000001.00000002.1627395778.0000000006B60000.00000004.08000000.00040000.00000000.sdmp, refff.exe, 00000003.00000002.1756161473.0000000004219000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1996938622.0000000004390000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: HPpn8C:\Windows\InstallUtil.pdbVW source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdbH source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\InstallUtil.pdbm source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\InstallUtil.pdb";7 source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdbT source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.PDB source: InstallUtil.exe, 00000007.00000002.2685785447.0000000001308000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\InstallUtil.pdb> source: InstallUtil.exe, 00000007.00000002.2685785447.00000000012B8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?|nC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: @|n.pdb source: InstallUtil.exe, 00000007.00000002.2684220078.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

barindex
Source: Ref#5010038.exe, -.cs .Net Code: _E001
Source: Ref#5010038.exe, -.cs .Net Code: _E009 System.Reflection.Assembly.Load(byte[])
Source: Ref#5010038.exe, Nxmvahhjirl.cs .Net Code: Nthjd System.Reflection.Assembly.Load(byte[])
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, ReflectionHelper.cs .Net Code: InvokeMethod
Source: 1.2.Ref#5010038.exe.3f7a038.1.raw.unpack, XmlSerializationHelper.cs .Net Code: ReadObjectProperties
Source: 1.2.Ref#5010038.exe.6b60000.10.raw.unpack, TypeModel.cs .Net Code: TryDeserializeList
Source: 1.2.Ref#5010038.exe.6b60000.10.raw.unpack, ListDecorator.cs .Net Code: Read
Source: 1.2.Ref#5010038.exe.6b60000.10.raw.unpack, TypeSerializer.cs .Net Code: CreateInstance
Source: 1.2.Ref#5010038.exe.6b60000.10.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateInstance
Source: 1.2.Ref#5010038.exe.6b60000.10.raw.unpack, TypeSerializer.cs .Net Code: EmitCreateIfNull
Source: Yara match File source: 3.2.refff.exe.6d90000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.6a50000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.6a50000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.6d90000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.1767572379.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1627107761.0000000006A50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1597457186.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1965684457.0000000003367000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Ref#5010038.exe PID: 8036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gtent.exe PID: 3340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D3CDE4 push esi; ret 1_2_05D3CDE5
Source: C:\Users\user\Desktop\Ref#5010038.exe Code function: 1_2_05D3CDB0 push ebx; ret 1_2_05D3CDB1
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 3_2_07736900 push edx; retf 3_2_0773690B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 4_2_00900C77 push edi; retf 4_2_00900C7A
Source: C:\Users\user\AppData\Roaming\gtent.exe Code function: 6_2_069E1C11 push es; ret 6_2_069E1C14
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_05AF0ADA push es; ret 13_2_05AF0AE0
Source: C:\Users\user\AppData\Local\Temp\refff.exe Code function: 13_2_06FC6900 push edx; retf 13_2_06FC690B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_008E0C77 push edi; retf 14_2_008E0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_05C8D9CE push es; retn 5005h 14_2_05C8D9DA
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Local\Temp\refff.exe Jump to dropped file
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Roaming\gtent.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Boot Survival

barindex
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs Jump to dropped file
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtent.vbs Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Source: Yara match File source: Process Memory Space: Ref#5010038.exe PID: 8036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gtent.exe PID: 3340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: Ref#5010038.exe, 00000001.00000002.1597457186.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1965684457.0000000003367000.00000004.00000800.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: C:\Users\user\Desktop\Ref#5010038.exe Memory allocated: E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Memory allocated: 2C70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Memory allocated: 2B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 14D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 3210000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 3020000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 900000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2560000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory allocated: 14B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory allocated: 32F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory allocated: 1880000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 1250000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2E80000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 4E80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 2650000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 2800000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\refff.exe Memory allocated: 4800000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 8E0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 2420000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 21C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 23F0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 25B0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 45B0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Window / User API: threadDelayed 1759 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Window / User API: threadDelayed 5778 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Window / User API: threadDelayed 2003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Window / User API: threadDelayed 2722 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 480 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 2902 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Window / User API: threadDelayed 3723 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Window / User API: threadDelayed 6045 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Window / User API: threadDelayed 2467
Source: C:\Users\user\AppData\Local\Temp\refff.exe Window / User API: threadDelayed 4023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 1152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Window / User API: threadDelayed 2232
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -23980767295822402s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8124 Thread sleep count: 1759 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8124 Thread sleep count: 5778 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99749s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99617s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99514s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99405s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99292s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99155s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -99030s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98807s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98682s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98576s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98346s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98233s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98124s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -98015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97900s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97577s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97249s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -97031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96702s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96371s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96155s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe TID: 8096 Thread sleep time: -96046s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7668 Thread sleep count: 2003 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7668 Thread sleep count: 2722 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99521s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99296s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99186s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -99076s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98968s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98858s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98528s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98414s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98311s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -98198s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -97937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -97437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -97327s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -97218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -97107s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -96999s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 7572 Thread sleep time: -96890s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1160 Thread sleep count: 480 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1160 Thread sleep count: 2902 > 30 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99766s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99642s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99516s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99405s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99297s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99187s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -99078s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98969s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98859s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98750s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98641s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98516s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98391s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98276s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5552 Thread sleep time: -98172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -27670116110564310s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 5652 Thread sleep count: 3723 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -99532s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -99366s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -99250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2056 Thread sleep count: 6045 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -99126s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -99000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98891s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98770s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98641s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98407s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98282s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -98063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -97084s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -96688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -96418s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -96310s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -96203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -96094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95235s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -95110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94985s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94235s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -94110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93959s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93823s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93677s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93539s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -93063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe TID: 2168 Thread sleep time: -92938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 4132 Thread sleep count: 2467 > 30
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 5264 Thread sleep count: 4023 > 30
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99652s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99408s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99171s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -99062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -98949s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -98842s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -98731s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -98609s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -98343s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97602s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97375s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97265s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -97031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96921s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96703s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96250s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -96031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -95921s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -95812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -95703s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -95563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\refff.exe TID: 2044 Thread sleep time: -95388s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6748 Thread sleep count: 1152 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6748 Thread sleep count: 2232 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99763s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99657s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99407s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99282s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99157s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -99032s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98907s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98313s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -98078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4520 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4424 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99859 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99749 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99617 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99514 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99405 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99292 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99155 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 99030 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98921 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98807 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98682 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98576 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98346 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98233 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98124 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 98015 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97900 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97796 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97687 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97577 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97468 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97359 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97249 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97140 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 97031 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96921 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96812 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96702 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96593 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96484 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96371 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96265 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96155 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Thread delayed: delay time: 96046 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99859 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99521 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99296 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99186 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99076 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98968 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98858 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98528 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98414 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98311 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98198 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97437 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97327 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97218 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97107 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96999 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96890 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99766 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99642 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99405 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99297 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99187 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99078 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98969 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98859 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98750 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98641 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98516 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98391 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98276 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98172 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 99532 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 99366 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 99250 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 99126 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 99000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98891 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98770 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98641 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98516 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98407 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98282 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98172 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 98063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97813 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97688 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97563 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97219 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 97084 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 96688 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 96418 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 96310 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 96203 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 96094 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95969 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95860 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95735 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95610 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95485 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95360 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95235 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 95110 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94985 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94860 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94735 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94610 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94485 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94360 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94235 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 94110 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93959 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93823 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93677 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93539 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93422 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93313 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93188 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 93063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Thread delayed: delay time: 92938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99652
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99408
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99281
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99171
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 99062
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98949
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98842
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98731
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98609
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 98343
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97602
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97484
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97375
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97265
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97155
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 97031
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96921
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96812
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96703
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96593
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96484
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96250
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 96031
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 95921
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 95812
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 95703
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 95563
Source: C:\Users\user\AppData\Local\Temp\refff.exe Thread delayed: delay time: 95388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99657
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 99032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98907
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 98078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ Jump to behavior
Source: Ref#5010038.exe, 00000001.00000002.1628016950.0000000007278000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: gtent.exe, 00000006.00000002.1962010506.0000000001531000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: refff.exe, 00000003.00000002.1736798540.0000000001235000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: refff.exe, 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware|VIRTUAL|A M I|Xen
Source: Ref#5010038.exe, 00000001.00000002.1596776459.0000000000ED1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: refff.exe, 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Microsoft|VMWare|Virtual
Source: InstallUtil.exe, 00000004.00000002.1987255180.00000000058FD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: Ref#5010038.exe, 00000001.00000002.1596776459.0000000000F2F000.00000004.00000020.00020000.00000000.sdmp, gtent.exe, 00000006.00000002.1962010506.0000000001585000.00000004.00000020.00020000.00000000.sdmp, refff.exe, 0000000D.00000002.2122264075.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2703171033.000000000578B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Ref#5010038.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Source: C:\Users\user\Desktop\Ref#5010038.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 21E008 Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe" Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Roaming\gtent.exe "C:\Users\user\AppData\Roaming\gtent.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Users\user\AppData\Local\Temp\refff.exe "C:\Users\user\AppData\Local\Temp\refff.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\Ref#5010038.exe Queries volume information: C:\Users\user\Desktop\Ref#5010038.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Ref#5010038.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Users\user\AppData\Local\Temp\refff.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Queries volume information: C:\Users\user\AppData\Roaming\gtent.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\gtent.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Users\user\AppData\Local\Temp\refff.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\refff.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Ref#5010038.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 6.2.gtent.exe.4336438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.InstallUtil.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.gtent.exe.4336438.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.2689096568.00000000024A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.00000000046E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1961029555.0000000000162000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2689096568.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2689096568.000000000249C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.0000000004321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Ref#5010038.exe PID: 8036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gtent.exe PID: 3340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6364, type: MEMORYSTR
Source: Yara match File source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: Yara match File source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7940, type: MEMORYSTR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\FTP Navigator\Ftplist.txt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: Yara match File source: 6.2.gtent.exe.4336438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.InstallUtil.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.gtent.exe.4336438.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.00000000046E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1961029555.0000000000162000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2689096568.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.0000000004321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Ref#5010038.exe PID: 8036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gtent.exe PID: 3340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6364, type: MEMORYSTR

Remote Access Functionality

barindex
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 6.2.gtent.exe.4336438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.Ref#5010038.exe.4077dd8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.InstallUtil.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.gtent.exe.4336438.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.2689096568.00000000024A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1619952243.0000000004062000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1619952243.0000000003DC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.00000000046E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1961029555.0000000000162000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2689096568.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2689096568.000000000249C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1996938622.0000000004321000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1967348275.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Ref#5010038.exe PID: 8036, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: gtent.exe PID: 3340, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 6364, type: MEMORYSTR
Source: Yara match File source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: Yara match File source: 13.2.refff.exe.29a4504.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.InstallUtil.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.refff.exe.29a4504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.33b4804.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.refff.exe.33b4804.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2152039226.00000000003A2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1738852630.0000000003288000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2125417632.0000000002878000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: refff.exe PID: 7428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: refff.exe PID: 5268, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: InstallUtil.exe PID: 7940, type: MEMORYSTR
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs