Source: |
Binary string: wntdll.pdbUGP source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355256966.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1354588446.0000000004640000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355256966.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1354588446.0000000004640000.00000004.00001000.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, |
1_2_00452492 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
1_2_00442886 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
1_2_004788BD |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, |
1_2_004339B6 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, |
1_2_0045CAFA |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
1_2_00431A86 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, |
1_2_0044BD27 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045DE8F FindFirstFileW,FindClose, |
1_2_0045DE8F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, |
1_2_0044BF8B |
Source: RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://cp8nl.hyperhost.ua |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DC8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DC8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06 |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0# |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DC8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0 |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.sectigo.com0 |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2600972823.0000000000402000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: RegSvcs.exe, 00000004.00000002.2605126818.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2603275945.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2605126818.0000000005DA1000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://sectigo.com/CPS0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, |
1_2_0045A10F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, |
1_2_0045A10F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
1_2_0047C81C |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle, |
1_2_00431BE8 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, |
1_2_00446313 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, |
1_2_004333BE |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0042200C |
1_2_0042200C |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0041A217 |
1_2_0041A217 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00412216 |
1_2_00412216 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0042435D |
1_2_0042435D |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004033C0 |
1_2_004033C0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044F430 |
1_2_0044F430 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004125E8 |
1_2_004125E8 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044663B |
1_2_0044663B |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004096A0 |
1_2_004096A0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00413801 |
1_2_00413801 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0042096F |
1_2_0042096F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004129D0 |
1_2_004129D0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004119E3 |
1_2_004119E3 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0041C9AE |
1_2_0041C9AE |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0047EA6F |
1_2_0047EA6F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0040FA10 |
1_2_0040FA10 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044EB5F |
1_2_0044EB5F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00423C81 |
1_2_00423C81 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00411E78 |
1_2_00411E78 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00442E0C |
1_2_00442E0C |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00420EC0 |
1_2_00420EC0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044CF17 |
1_2_0044CF17 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00444FD2 |
1_2_00444FD2 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0407BF00 |
1_2_0407BF00 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029E9388 |
4_2_029E9388 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029E4A98 |
4_2_029E4A98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029E9B48 |
4_2_029E9B48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029E3E80 |
4_2_029E3E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029ECEA0 |
4_2_029ECEA0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_029E41C8 |
4_2_029E41C8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EAACDC |
4_2_05EAACDC |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EA96B0 |
4_2_05EA96B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EABDF8 |
4_2_05EABDF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EADBF0 |
4_2_05EADBF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05ECBCE8 |
4_2_05ECBCE8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05ECDCF8 |
4_2_05ECDCF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC3F30 |
4_2_05EC3F30 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC56C0 |
4_2_05EC56C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC0040 |
4_2_05EC0040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC8B78 |
4_2_05EC8B78 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC2AE8 |
4_2_05EC2AE8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC9AD0 |
4_2_05EC9AD0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC4FE0 |
4_2_05EC4FE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 4_2_05EC3238 |
4_2_05EC3238 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: String function: 004115D7 appears 36 times |
|
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: String function: 00416C70 appears 39 times |
|
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: String function: 00445AE0 appears 65 times |
|
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355035918.0000000004763000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355256966.000000000490D000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamefc5dce39-38f8-4333-8bf2-0b26de43131c.exe4 vs z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 4JJG6X.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 4JJG6X.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 8C78isHTVco.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 8C78isHTVco.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 8C78isHTVco.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, 8C78isHTVco.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, CqSP68Ir.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, CqSP68Ir.cs |
Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, |
1_2_004333BE |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, |
1_2_00464EAE |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, |
1_2_0043305F |
Source: unknown |
Process created: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe "C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe" |
|
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe" |
|
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: |
Binary string: wntdll.pdbUGP source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355256966.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1354588446.0000000004640000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1355256966.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, z1RFT798549034687-HJW90789-VXT9KGUINUII.exe, 00000001.00000003.1354588446.0000000004640000.00000004.00001000.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
1_2_0047A330 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
1_2_00434418 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, |
1_2_00452492 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
1_2_00442886 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
1_2_004788BD |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, |
1_2_004339B6 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, |
1_2_0045CAFA |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
1_2_00431A86 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, |
1_2_0044BD27 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0045DE8F FindFirstFileW,FindClose, |
1_2_0045DE8F |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, |
1_2_0044BF8B |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, |
1_2_0040E500 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99874 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99763 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99656 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99546 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99436 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99318 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99203 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99037 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98920 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98787 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98668 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98562 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98453 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98343 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98220 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98093 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97983 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97874 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97765 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97656 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97546 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97437 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97328 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97218 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97109 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96999 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96890 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96781 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96671 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96562 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96452 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, |
1_2_0040D590 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0407A740 mov eax, dword ptr fs:[00000030h] |
1_2_0407A740 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0407BD90 mov eax, dword ptr fs:[00000030h] |
1_2_0407BD90 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0407BDF0 mov eax, dword ptr fs:[00000030h] |
1_2_0407BDF0 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock, |
1_2_004238DA |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0041F250 SetUnhandledExceptionFilter, |
1_2_0041F250 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
1_2_0041A208 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
1_2_00417DAA |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, |
1_2_0040D590 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
1_2_00434418 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
1_2_00446124 |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: Shell_TrayWnd |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW, |
1_2_004720DB |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, |
1_2_0041E364 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary, |
1_2_0040E500 |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2600972823.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe PID: 6908, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3104, type: MEMORYSTR |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities |
Jump to behavior |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: WIN_XP |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----& |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: WIN_XPe |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: WIN_VISTA |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: WIN_7 |
Source: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Binary or memory string: WIN_8 |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2600972823.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe PID: 6908, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3104, type: MEMORYSTR |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.z1RFT798549034687-HJW90789-VXT9KGUINUII.exe.1690000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.1358495773.0000000001690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2600972823.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000004.00000002.2603275945.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: z1RFT798549034687-HJW90789-VXT9KGUINUII.exe PID: 6908, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3104, type: MEMORYSTR |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, |
1_2_004652BE |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, |
1_2_00476619 |
Source: C:\Users\user\Desktop\z1RFT798549034687-HJW90789-VXT9KGUINUII.exe |
Code function: 1_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, |
1_2_0046CEF3 |