Source: |
Binary string: wntdll.pdbUGP source: RFQ-HL51L05.exe, 00000000.00000003.2063316779.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.2060169865.0000000003C10000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: RFQ-HL51L05.exe, 00000000.00000003.2063316779.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.2060169865.0000000003C10000.00000004.00001000.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F44696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00F44696 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_00F4C9C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4C93C FindFirstFileW,FindClose, |
0_2_00F4C93C |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00F4F200 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00F4F35D |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00F4F65E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F43A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00F43A2B |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F43D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00F43D4E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00F4BF27 |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://cmcapama.top |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://mail.cmcapama.top |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A40000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300886228.0000000000A30000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.i.lencr.org/0 |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A40000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300886228.0000000000A30000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://r3.o.lencr.org0 |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A40000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300886228.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300706007.00000000009D4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://x1.c.lencr.org/0 |
Source: RegSvcs.exe, 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3303315424.0000000005A40000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300886228.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300706007.00000000009D4000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://x1.i.lencr.org/0 |
Source: RFQ-HL51L05.exe, 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3300590413.00000000007C2000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F5425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_00F5425A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F5425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_00F5425A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F40219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, |
0_2_00F40219 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F6CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_00F6CDAC |
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: This is a third-party compiled AutoIt script. |
0_2_00EE3B4C |
Source: RFQ-HL51L05.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
|
Source: RFQ-HL51L05.exe, 00000000.00000002.2067517855.0000000000F95000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_f1c9ecbd-c |
Source: RFQ-HL51L05.exe, 00000000.00000002.2067517855.0000000000F95000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_1968dd43-d |
Source: RFQ-HL51L05.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_bf2593e8-a |
Source: RFQ-HL51L05.exe |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_2bd4949c-f |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F38858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, |
0_2_00F38858 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EEE800 |
0_2_00EEE800 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F0DBB5 |
0_2_00F0DBB5 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EEE060 |
0_2_00EEE060 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F6804A |
0_2_00F6804A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF4140 |
0_2_00EF4140 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F02405 |
0_2_00F02405 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F16522 |
0_2_00F16522 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F1267E |
0_2_00F1267E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F60665 |
0_2_00F60665 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF6843 |
0_2_00EF6843 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F0283A |
0_2_00F0283A |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F189DF |
0_2_00F189DF |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F60AE2 |
0_2_00F60AE2 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F16A94 |
0_2_00F16A94 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF8A0E |
0_2_00EF8A0E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F48B13 |
0_2_00F48B13 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F3EB07 |
0_2_00F3EB07 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F0CD61 |
0_2_00F0CD61 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F17006 |
0_2_00F17006 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF3190 |
0_2_00EF3190 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF710E |
0_2_00EF710E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EE1287 |
0_2_00EE1287 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F033C7 |
0_2_00F033C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F0F419 |
0_2_00F0F419 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F016C4 |
0_2_00F016C4 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF5680 |
0_2_00EF5680 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F078D3 |
0_2_00F078D3 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EF58C0 |
0_2_00EF58C0 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F01BB8 |
0_2_00F01BB8 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F19D05 |
0_2_00F19D05 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EEFE40 |
0_2_00EEFE40 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F0BFE6 |
0_2_00F0BFE6 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F01FD0 |
0_2_00F01FD0 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_011B3680 |
0_2_011B3680 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BB41C8 |
2_2_04BB41C8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BB9370 |
2_2_04BB9370 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BB3E80 |
2_2_04BB3E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BBCE68 |
2_2_04BBCE68 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BB4A98 |
2_2_04BB4A98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_04BB9B30 |
2_2_04BB9B30 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AFBCC8 |
2_2_05AFBCC8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AFDCD8 |
2_2_05AFDCD8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF3F08 |
2_2_05AF3F08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF5690 |
2_2_05AF5690 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF0040 |
2_2_05AF0040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF8B48 |
2_2_05AF8B48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF9AA0 |
2_2_05AF9AA0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF2AF0 |
2_2_05AF2AF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF4FB0 |
2_2_05AF4FB0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_05AF3208 |
2_2_05AF3208 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00F08B40 appears 42 times |
|
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00EE7F41 appears 35 times |
|
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: String function: 00F00D27 appears 70 times |
|
Source: RFQ-HL51L05.exe, 00000000.00000003.2060169865.0000000003D3D000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-HL51L05.exe |
Source: RFQ-HL51L05.exe, 00000000.00000003.2060028762.0000000003B93000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-HL51L05.exe |
Source: RFQ-HL51L05.exe, 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilename2476821b-522d-4413-ae7d-3517dfb022e4.exe4 vs RFQ-HL51L05.exe |
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, cPs8D.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, 72CF8egH.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, G5CXsdn.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, 3uPsILA6U.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, 6oQOw74dfIt.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, aMIWm.cs |
Cryptographic APIs: 'CreateDecryptor', 'TransformBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, 3QjbQ514BDx.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, 3QjbQ514BDx.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: RFQ-HL51L05.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: |
Binary string: wntdll.pdbUGP source: RFQ-HL51L05.exe, 00000000.00000003.2063316779.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.2060169865.0000000003C10000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: RFQ-HL51L05.exe, 00000000.00000003.2063316779.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, RFQ-HL51L05.exe, 00000000.00000003.2060169865.0000000003C10000.00000004.00001000.00020000.00000000.sdmp |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata |
Source: RFQ-HL51L05.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EE4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_00EE4A35 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F655FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
0_2_00F655FD |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F033C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, |
0_2_00F033C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F44696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00F44696 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_00F4C9C7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4C93C FindFirstFileW,FindClose, |
0_2_00F4C93C |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00F4F200 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00F4F35D |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00F4F65E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F43A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00F43A2B |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F43D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00F43D4E |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F4BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00F4BF27 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99891 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99766 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99657 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99532 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99422 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99313 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99188 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99063 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98938 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98513 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98407 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98297 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98188 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98063 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97938 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97688 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97579 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97454 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97329 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97204 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97079 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96954 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96829 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96704 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96579 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F15CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, |
0_2_00F15CCC |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F381F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_00F381F7 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00EE4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_00EE4A35 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F381F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_00F381F7 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F1418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, |
0_2_00F1418A |
Source: Yara match |
File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.3301412264.0000000002729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3300590413.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3301412264.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 5012, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 4924, type: MEMORYSTR |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities |
Jump to behavior |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_81 |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_XP |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_XPe |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_VISTA |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_7 |
Source: RFQ-HL51L05.exe |
Binary or memory string: WIN_8 |
Source: RFQ-HL51L05.exe |
Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte |
Source: Yara match |
File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3300590413.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3301412264.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 5012, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 4924, type: MEMORYSTR |
Source: Yara match |
File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.RFQ-HL51L05.exe.1260000.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.3301412264.0000000002729000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3301412264.00000000026FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.2068321175.0000000001260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3300590413.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.3301412264.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: RFQ-HL51L05.exe PID: 5012, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 4924, type: MEMORYSTR |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F56596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, |
0_2_00F56596 |
Source: C:\Users\user\Desktop\RFQ-HL51L05.exe |
Code function: 0_2_00F56A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket, |
0_2_00F56A5A |