Source: MT 103.exe, 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp |
String found in binary or memory: http://127.0.0.1:HTTP/1.1 |
Source: MT 103.exe, 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp |
String found in binary or memory: http://DynDns.comDynDNS |
Source: MT 103.exe, 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp |
String found in binary or memory: http://HGYsjc.com |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0 |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://cps.letsencrypt.org0 |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://cps.root-x1.letsencrypt.org0 |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0 |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://r3.i.lencr.org/0 |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
String found in binary or memory: http://r3.o.lencr.org0 |
Source: MT 103.exe, 00000000.00000002.248507355.0000000002EF1000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: MT 103.exe, 00000001.00000002.618858084.0000000002C72000.00000004.00000001.sdmp |
String found in binary or memory: http://smtp.vivaldi.net |
Source: MT 103.exe |
String found in binary or memory: http://thesnake.herokuapp.com/snakes |
Source: MT 103.exe, 00000001.00000002.618540994.0000000002C12000.00000004.00000001.sdmp |
String found in binary or memory: https://RUj6sv9z4cuyCVePS.org |
Source: MT 103.exe, 00000000.00000002.249712252.0000000003EF9000.00000004.00000001.sdmp, MT 103.exe, 00000001.00000002.616043319.0000000000402000.00000040.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip |
Source: MT 103.exe, 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 0_2_02EBC508 |
0_2_02EBC508 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 0_2_02EB9990 |
0_2_02EB9990 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 0_2_0626AF80 |
0_2_0626AF80 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 0_2_06266058 |
0_2_06266058 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01058400 |
1_2_01058400 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01050040 |
1_2_01050040 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_010533C1 |
1_2_010533C1 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01052608 |
1_2_01052608 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01059900 |
1_2_01059900 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_0105EDC8 |
1_2_0105EDC8 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01059850 |
1_2_01059850 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01062D50 |
1_2_01062D50 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01062020 |
1_2_01062020 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_0106E0C0 |
1_2_0106E0C0 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_0106BF58 |
1_2_0106BF58 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_0106AB70 |
1_2_0106AB70 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01062618 |
1_2_01062618 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_01069DB8 |
1_2_01069DB8 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D46A0 |
1_2_050D46A0 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D35C4 |
1_2_050D35C4 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D3D50 |
1_2_050D3D50 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050DDA10 |
1_2_050DDA10 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D4630 |
1_2_050D4630 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D4690 |
1_2_050D4690 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D35B8 |
1_2_050D35B8 |
Source: C:\Users\user\Desktop\MT 103.exe |
Code function: 1_2_050D5393 |
1_2_050D5393 |
Source: MT 103.exe |
Binary or memory string: OriginalFilename vs MT 103.exe |
Source: MT 103.exe, 00000000.00000000.242100872.0000000000A72000.00000002.00020000.sdmp |
Binary or memory string: OriginalFilenameRestrictedErrorObject.exe2 vs MT 103.exe |
Source: MT 103.exe, 00000000.00000002.253587991.00000000061D0000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenamePositiveSign.dll< vs MT 103.exe |
Source: MT 103.exe, 00000000.00000002.248576551.0000000002F22000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameSoapName.dll2 vs MT 103.exe |
Source: MT 103.exe, 00000000.00000002.248507355.0000000002EF1000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameMbUGqFFoWcXbQVSprfqpYEIMoykwB.exe4 vs MT 103.exe |
Source: MT 103.exe |
Binary or memory string: OriginalFilename vs MT 103.exe |
Source: MT 103.exe, 00000001.00000002.617959918.0000000001200000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamewshom.ocx vs MT 103.exe |
Source: MT 103.exe, 00000001.00000002.616333882.00000000008E2000.00000002.00020000.sdmp |
Binary or memory string: OriginalFilenameRestrictedErrorObject.exe2 vs MT 103.exe |
Source: MT 103.exe, 00000001.00000002.622690326.0000000006340000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamemscorrc.dllT vs MT 103.exe |
Source: MT 103.exe, 00000001.00000002.616537778.0000000000D38000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MT 103.exe |
Source: MT 103.exe, 00000001.00000002.616043319.0000000000402000.00000040.00000001.sdmp |
Binary or memory string: OriginalFilenameMbUGqFFoWcXbQVSprfqpYEIMoykwB.exe4 vs MT 103.exe |
Source: MT 103.exe |
Binary or memory string: OriginalFilenameRestrictedErrorObject.exe2 vs MT 103.exe |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: MT 103.exe, 00000000.00000002.248576551.0000000002F22000.00000004.00000001.sdmp |
Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\ |
Source: MT 103.exe, 00000000.00000002.248576551.0000000002F22000.00000004.00000001.sdmp |
Binary or memory string: vmware |
Source: MT 103.exe, 00000001.00000002.617564319.0000000000F87000.00000004.00000020.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY- |
Source: MT 103.exe, 00000000.00000002.248576551.0000000002F22000.00000004.00000001.sdmp |
Binary or memory string: VMware SVGA II |
Source: MT 103.exe, 00000000.00000002.248576551.0000000002F22000.00000004.00000001.sdmp |
Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools |
Source: MT 103.exe, 00000001.00000002.618275722.0000000001640000.00000002.00000001.sdmp |
Binary or memory string: Shell_TrayWnd |
Source: MT 103.exe, 00000001.00000002.618275722.0000000001640000.00000002.00000001.sdmp |
Binary or memory string: Progman |
Source: MT 103.exe, 00000001.00000002.618275722.0000000001640000.00000002.00000001.sdmp |
Binary or memory string: SProgram Managerl |
Source: MT 103.exe, 00000001.00000002.618275722.0000000001640000.00000002.00000001.sdmp |
Binary or memory string: Shell_TrayWnd, |
Source: MT 103.exe, 00000001.00000002.618275722.0000000001640000.00000002.00000001.sdmp |
Binary or memory string: Progmanlock |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Users\user\Desktop\MT 103.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Users\user\Desktop\MT 103.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\MT 103.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: Yara match |
File source: 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.618540994.0000000002C12000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.616043319.0000000000402000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.618470302.0000000002BE5000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.249712252.0000000003EF9000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: MT 103.exe PID: 6452, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: MT 103.exe PID: 6524, type: MEMORY |
Source: Yara match |
File source: 1.2.MT 103.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000001.00000002.618421104.0000000002BB1000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.618540994.0000000002C12000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.616043319.0000000000402000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.618470302.0000000002BE5000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.249712252.0000000003EF9000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: MT 103.exe PID: 6452, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: MT 103.exe PID: 6524, type: MEMORY |
Source: Yara match |
File source: 1.2.MT 103.exe.400000.0.unpack, type: UNPACKEDPE |