Source: |
Binary string: wntdll.pdbUGP source: RFQ-HL51L05.exe, 00000000.00000003.1977085404.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.1977994007.0000000003940000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: RFQ-HL51L05.exe, 00000000.00000003.1977085404.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.1977994007.0000000003940000.00000004.00001000.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00474696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00474696 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047C93C FindFirstFileW,FindClose, |
0_2_0047C93C |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_0047C9C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0047F200 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0047F35D |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_0047F65E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00473A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00473A2B |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00473D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00473D4E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_0047BF27 |
Source: RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://cmcapama.top |
Source: RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://mail.cmcapama.top |
Source: RegSvcs.exe, 00000002.00000002.3211824610.0000000006080000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.i.lencr. |
Source: RegSvcs.exe, 00000002.00000002.3209862719.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.0000000006080000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.i.lencr.org/0 |
Source: RegSvcs.exe, 00000002.00000002.3209862719.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.0000000006080000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.o.lencr.org0 |
Source: RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.00000000060D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.0000000006080000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.000000000609E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://x1.c.lencr.org/0 |
Source: RegSvcs.exe, 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.00000000060D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.0000000006080000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3211824610.000000000609E000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://x1.i.lencr.org/0 |
Source: RFQ-HL51L05.exe, 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3209598089.0000000000402000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0048425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_0048425A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0048425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_0048425A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00470219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, |
0_2_00470219 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0049CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_0049CDAC |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: This is a third-party compiled AutoIt script. |
0_2_00413B4C |
Source: RFQ-HL51L05.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
|
Source: RFQ-HL51L05.exe, 00000000.00000000.1967305315.00000000004C5000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_08102c8b-f |
Source: RFQ-HL51L05.exe, 00000000.00000000.1967305315.00000000004C5000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_df8ee515-f |
Source: RFQ-HL51L05.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_2e80412a-5 |
Source: RFQ-HL51L05.exe |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_482be466-3 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00468858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, |
0_2_00468858 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0041E800 |
0_2_0041E800 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0043DBB5 |
0_2_0043DBB5 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0049804A |
0_2_0049804A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0041E060 |
0_2_0041E060 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00424140 |
0_2_00424140 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00432405 |
0_2_00432405 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00446522 |
0_2_00446522 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00490665 |
0_2_00490665 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0044267E |
0_2_0044267E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00426843 |
0_2_00426843 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0043283A |
0_2_0043283A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004489DF |
0_2_004489DF |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00428A0E |
0_2_00428A0E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00490AE2 |
0_2_00490AE2 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00446A94 |
0_2_00446A94 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0046EB07 |
0_2_0046EB07 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00478B13 |
0_2_00478B13 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0043CD61 |
0_2_0043CD61 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00447006 |
0_2_00447006 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0042710E |
0_2_0042710E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00423190 |
0_2_00423190 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00411287 |
0_2_00411287 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004333C7 |
0_2_004333C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0043F419 |
0_2_0043F419 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004316C4 |
0_2_004316C4 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00425680 |
0_2_00425680 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004258C0 |
0_2_004258C0 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004378D3 |
0_2_004378D3 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00431BB8 |
0_2_00431BB8 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00449D05 |
0_2_00449D05 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0041FE40 |
0_2_0041FE40 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00431FD0 |
0_2_00431FD0 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0043BFE6 |
0_2_0043BFE6 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EB3660 |
0_2_00EB3660 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A34A98 |
2_2_02A34A98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A39B30 |
2_2_02A39B30 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A33E80 |
2_2_02A33E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A3CE68 |
2_2_02A3CE68 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A341C8 |
2_2_02A341C8 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00438B40 appears 42 times |
|
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00417F41 appears 35 times |
|
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00430D27 appears 70 times |
|
Source: RFQ-HL51L05.exe, 00000000.00000003.1976310140.00000000038C3000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-HL51L05.exe |
Source: RFQ-HL51L05.exe, 00000000.00000003.1976827525.0000000003A6D000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-HL51L05.exe |
Source: RFQ-HL51L05.exe, 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilename2476821b-522d-4413-ae7d-3517dfb022e4.exe4 vs RFQ-HL51L05.exe |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, cPs8D.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, 72CF8egH.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, G5CXsdn.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, 3uPsILA6U.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, 6oQOw74dfIt.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, aMIWm.cs |
Cryptographic APIs: 'CreateDecryptor', 'TransformBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, 3QjbQ514BDx.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, 3QjbQ514BDx.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: |
Binary string: wntdll.pdbUGP source: RFQ-HL51L05.exe, 00000000.00000003.1977085404.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.1977994007.0000000003940000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: RFQ-HL51L05.exe, 00000000.00000003.1977085404.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.1977994007.0000000003940000.00000004.00001000.00020000.00000000.sdmp |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00438B85 push ecx; ret |
0_2_00438B98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A30698 push eax; ret |
2_2_02A30712 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A30698 push eax; ret |
2_2_02A30722 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A306C8 push eax; ret |
2_2_02A306F2 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A306C8 push eax; ret |
2_2_02A30702 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A30728 push eax; ret |
2_2_02A30732 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A30708 push eax; ret |
2_2_02A30712 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_02A30718 push eax; ret |
2_2_02A30722 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00414A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_00414A35 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004955FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
0_2_004955FD |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004333C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, |
0_2_004333C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00474696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00474696 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047C93C FindFirstFileW,FindClose, |
0_2_0047C93C |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_0047C9C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0047F200 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0047F35D |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_0047F65E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00473A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00473A2B |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00473D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00473D4E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0047BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_0047BF27 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99874 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99765 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99656 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99546 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99437 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99328 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99218 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99109 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98890 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98781 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98671 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98562 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98452 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98343 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98234 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98122 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98015 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97906 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97796 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97687 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97578 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97468 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97359 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97250 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97140 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97031 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96915 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96796 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96687 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96578 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96468 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96359 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96249 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96140 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96031 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95921 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95812 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95593 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95484 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95374 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95265 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95156 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95045 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 94936 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00445CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, |
0_2_00445CCC |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004681F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_004681F7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00414A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_00414A35 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_004681F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_004681F7 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_0044418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, |
0_2_0044418A |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002CB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3209598089.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 1968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 1988, type: MEMORYSTR |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities |
Jump to behavior |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_81 |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_XP |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_XPe |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_VISTA |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_7 |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_8 |
Source: RFQ-HL51L05.exe |
Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3209598089.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 1968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 1988, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.ed0000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002CB8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3210387790.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1979105607.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3209598089.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 1968, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 1988, type: MEMORYSTR |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00486596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, |
0_2_00486596 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00486A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket, |
0_2_00486A5A |