Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 173.222.162.64 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 23.40.205.49 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 23.40.205.49 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.0000000003451000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: MSBuild.exe, 00000006.00000002.3397111057.0000000002241000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://us2.smtp.mailhostbox.com |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007351000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3394408045.0000000000412000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.0000000003451000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://fotohari.kylos.pl |
Source: rTDN001-180424_PDF.scr.exe |
String found in binary or memory: https://fotohari.kylos.pl/ab/wp-admin/Ztmwr.vdf |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/mgravell/protobuf-net |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/mgravell/protobuf-netJ |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/mgravell/protobuf-neti |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://stackoverflow.com/q/11564914/23354; |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://stackoverflow.com/q/14436606/23354 |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp, rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://stackoverflow.com/q/2152978/23354 |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Code function: 0_2_0731DAB0 |
0_2_0731DAB0 |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Code function: 0_2_0730003F |
0_2_0730003F |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Code function: 0_2_07300040 |
0_2_07300040 |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Code function: 0_2_0731CF48 |
0_2_0731CF48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0072CC6C |
6_2_0072CC6C |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0072A068 |
6_2_0072A068 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0072CC60 |
6_2_0072CC60 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0072BB58 |
6_2_0072BB58 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A9388 |
6_2_008A9388 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A4A98 |
6_2_008A4A98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A9C08 |
6_2_008A9C08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A3E80 |
6_2_008A3E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008ACEE8 |
6_2_008ACEE8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A41C8 |
6_2_008A41C8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0589BD08 |
6_2_0589BD08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_0589DD18 |
6_2_0589DD18 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05893F48 |
6_2_05893F48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_058956E0 |
6_2_058956E0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05890040 |
6_2_05890040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05898B98 |
6_2_05898B98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05899AE0 |
6_2_05899AE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05892AF0 |
6_2_05892AF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05895000 |
6_2_05895000 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_05893248 |
6_2_05893248 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008AD298 |
6_2_008AD298 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Code function: 6_2_008A9C00 |
6_2_008A9C00 |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2320169160.0000000006410000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: OriginalFilenameYuzpxyja.dll" vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.000000000516C000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2323481881.0000000006A00000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295249101.0000000001554000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameYuzpxyja.dll" vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295249101.000000000151E000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameclr.dllT vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295537311.0000000003190000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilename vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamed8163914-fcd5-4b57-938b-7e2b1937f939.exe4 vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2295741953.000000000349A000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.0000000004839000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameYuzpxyja.dll" vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007441000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2324238249.0000000007351000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamed8163914-fcd5-4b57-938b-7e2b1937f939.exe4 vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000002.2314314712.0000000004F3A000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameYuzpxyja.dll" vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe, 00000000.00000000.2147923681.0000000000FC8000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameVhyltr.exe. vs rTDN001-180424_PDF.scr.exe |
Source: rTDN001-180424_PDF.scr.exe |
Binary or memory string: OriginalFilenameVhyltr.exe. vs rTDN001-180424_PDF.scr.exe |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, TaskSecurity.cs |
Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges() |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, TaskSecurity.cs |
Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, TaskFolder.cs |
Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, TaskPrincipal.cs |
Security API names: System.Security.Principal.WindowsIdentity.GetCurrent() |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, TaskPrincipal.cs |
Security API names: System.Security.Principal.WindowsIdentity.GetCurrent() |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, TaskSecurity.cs |
Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges() |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, TaskSecurity.cs |
Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, Task.cs |
Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, Task.cs |
Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, User.cs |
Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, TaskFolder.cs |
Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections) |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, User.cs |
Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type) |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: rasapi32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: rasman.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: rtutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: schannel.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: mskeyprotect.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: ncryptsslp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: dhcpcsvc6.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: dhcpcsvc.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: rTDN001-180424_PDF.scr.exe, Program.cs |
.Net Code: DisplayResult System.AppDomain.Load(byte[]) |
Source: rTDN001-180424_PDF.scr.exe, JSONParser.cs |
.Net Code: ParseValue |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, ReflectionHelper.cs |
.Net Code: InvokeMethod |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, ReflectionHelper.cs |
.Net Code: InvokeMethod |
Source: 0.2.rTDN001-180424_PDF.scr.exe.6a00000.13.raw.unpack, XmlSerializationHelper.cs |
.Net Code: ReadObjectProperties |
Source: 0.2.rTDN001-180424_PDF.scr.exe.74a8e78.14.raw.unpack, TypeModel.cs |
.Net Code: TryDeserializeList |
Source: 0.2.rTDN001-180424_PDF.scr.exe.74a8e78.14.raw.unpack, ListDecorator.cs |
.Net Code: Read |
Source: 0.2.rTDN001-180424_PDF.scr.exe.74a8e78.14.raw.unpack, TypeSerializer.cs |
.Net Code: CreateInstance |
Source: 0.2.rTDN001-180424_PDF.scr.exe.74a8e78.14.raw.unpack, TypeSerializer.cs |
.Net Code: EmitCreateInstance |
Source: 0.2.rTDN001-180424_PDF.scr.exe.74a8e78.14.raw.unpack, TypeSerializer.cs |
.Net Code: EmitCreateIfNull |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, ReflectionHelper.cs |
.Net Code: InvokeMethod |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, ReflectionHelper.cs |
.Net Code: InvokeMethod |
Source: 0.2.rTDN001-180424_PDF.scr.exe.5219e80.7.raw.unpack, XmlSerializationHelper.cs |
.Net Code: ReadObjectProperties |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe TID: 2192 |
Thread sleep time: -30000s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe TID: 6928 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -20291418481080494s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -100000s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2096 |
Thread sleep count: 1778 > 30 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99891s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2096 |
Thread sleep count: 8074 > 30 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99766s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99528s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99420s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99313s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99188s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -99063s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98953s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98843s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98734s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98625s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98516s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98391s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98279s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98172s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -98061s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97953s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97844s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97734s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97625s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97516s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97391s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97266s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97156s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -97047s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96938s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96813s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96688s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96563s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96453s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96343s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96234s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96125s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -96016s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95906s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95797s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95688s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95563s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95438s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95313s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95203s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -95094s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94969s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94859s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94750s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94531s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2548 |
Thread sleep time: -94422s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99891 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99766 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99528 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99420 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99313 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99188 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 99063 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98953 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98843 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98734 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98625 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98516 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98391 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98279 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98172 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 98061 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97953 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97844 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97734 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97625 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97516 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97391 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97266 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97156 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 97047 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96938 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96688 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96563 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96453 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96343 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96234 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96125 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 96016 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95906 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95797 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95688 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95563 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95438 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95313 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95203 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 95094 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94969 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94859 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94750 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94531 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Thread delayed: delay time: 94422 |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Queries volume information: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\rTDN001-180424_PDF.scr.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a8ac38.8.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a62c18.9.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4adac58.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4f3acb8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.6410000.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.6410000.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a8ac38.8.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4f3acb8.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a62c18.9.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4adac58.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.2320169160.0000000006410000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2314314712.0000000004F3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2314314712.0000000004839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a8ac38.8.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a62c18.9.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4adac58.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4f3acb8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.6410000.11.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.6410000.11.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a8ac38.8.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4f3acb8.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4a62c18.9.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.rTDN001-180424_PDF.scr.exe.4adac58.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.2320169160.0000000006410000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2314314712.0000000004F3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2314314712.0000000004839000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |