Source: xVvAobZvWU.exe, 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp |
String found in binary or memory: http://127.0.0.1:HTTP/1.1 |
Source: xVvAobZvWU.exe, 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp |
String found in binary or memory: http://Bavw5lBQkDhG9.net |
Source: xVvAobZvWU.exe, 00000002.00000003.401682628.0000000001094000.00000004.00000001.sdmp |
String found in binary or memory: http://Bavw5lBQkDhG9.net1-5-21-3853321935-2125563209-4053062332-1002_Classes |
Source: xVvAobZvWU.exe, 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp |
String found in binary or memory: http://DynDns.comDynDNS |
Source: xVvAobZvWU.exe, 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp |
String found in binary or memory: http://UfeDnz.com |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0 |
Source: xVvAobZvWU.exe, 00000002.00000002.466430906.0000000003101000.00000004.00000001.sdmp |
String found in binary or memory: http://brimaq.com |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://cps.letsencrypt.org0 |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://cps.root-x1.letsencrypt.org0 |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0 |
Source: xVvAobZvWU.exe, 00000002.00000002.466430906.0000000003101000.00000004.00000001.sdmp |
String found in binary or memory: http://mail.brimaq.com |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://r3.i.lencr.org/0 |
Source: xVvAobZvWU.exe, 00000002.00000003.413844373.00000000012C7000.00000004.00000001.sdmp |
String found in binary or memory: http://r3.o.lencr.org0 |
Source: xVvAobZvWU.exe, 00000000.00000002.200144937.0000000003809000.00000004.00000001.sdmp, xVvAobZvWU.exe, 00000002.00000002.460161679.0000000000402000.00000040.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip |
Source: xVvAobZvWU.exe, 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 0_2_003A9245 |
0_2_003A9245 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 0_2_00D6C164 |
0_2_00D6C164 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 0_2_00D6E5B0 |
0_2_00D6E5B0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 0_2_00D6E5A0 |
0_2_00D6E5A0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 0_2_003A929D |
0_2_003A929D |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_00A59245 |
2_2_00A59245 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01122A98 |
2_2_01122A98 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01124418 |
2_2_01124418 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01122367 |
2_2_01122367 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01126D30 |
2_2_01126D30 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_0116F8EC |
2_2_0116F8EC |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_011603C5 |
2_2_011603C5 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_0116F3C0 |
2_2_0116F3C0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_0116BBCC |
2_2_0116BBCC |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01165E38 |
2_2_01165E38 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_0116A2C0 |
2_2_0116A2C0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01167228 |
2_2_01167228 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01169660 |
2_2_01169660 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_011754C0 |
2_2_011754C0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_0117B748 |
2_2_0117B748 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01176BE0 |
2_2_01176BE0 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_01174C30 |
2_2_01174C30 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Code function: 2_2_00A5929D |
2_2_00A5929D |
Source: xVvAobZvWU.exe, 00000000.00000002.202359814.0000000004D80000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamemscorrc.dllT vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000000.00000000.192493663.0000000000448000.00000002.00020000.sdmp |
Binary or memory string: OriginalFilename2A vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000000.00000002.202558284.0000000004DF0000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameMetroFramework.dll> vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000000.00000002.200144937.0000000003809000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameMKxlRmnrxoJfDTOrHckujWdZgfyhUUAQDs.exe4 vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000000.00000002.203440932.0000000005941000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameMajorRevision.exe< vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.463074346.00000000010A0000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamemscorrc.dllT vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.461233349.0000000000AF8000.00000002.00020000.sdmp |
Binary or memory string: OriginalFilename2A vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.460161679.0000000000402000.00000040.00000001.sdmp |
Binary or memory string: OriginalFilenameMKxlRmnrxoJfDTOrHckujWdZgfyhUUAQDs.exe4 vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.463491577.00000000011DA000.00000004.00000020.sdmp |
Binary or memory string: OriginalFilenameclr.dllT vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.463236763.0000000001130000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamewshom.ocx vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.461362348.0000000000EF8000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameUNKNOWN_FILET vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe, 00000002.00000002.463261981.0000000001140000.00000002.00000001.sdmp |
Binary or memory string: OriginalFilenamewshom.ocx.mui vs xVvAobZvWU.exe |
Source: xVvAobZvWU.exe |
Binary or memory string: OriginalFilename2A vs xVvAobZvWU.exe |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: vmware |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\ |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: VMWARE |
Source: xVvAobZvWU.exe, 00000002.00000002.463620670.0000000001249000.00000004.00000020.sdmp |
Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll' |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\ |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: VMware SVGA II |
Source: xVvAobZvWU.exe, 00000000.00000002.204367485.0000000005DA1000.00000004.00000001.sdmp |
Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Users\user\Desktop\xVvAobZvWU.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Users\user\Desktop\xVvAobZvWU.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\xVvAobZvWU.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: Yara match |
File source: 00000002.00000002.460161679.0000000000402000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.200144937.0000000003809000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: xVvAobZvWU.exe PID: 2584, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: xVvAobZvWU.exe PID: 5504, type: MEMORY |
Source: Yara match |
File source: 2.2.xVvAobZvWU.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.xVvAobZvWU.exe.39b33b0.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.xVvAobZvWU.exe.39b33b0.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.460161679.0000000000402000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.464571382.0000000002E51000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.200144937.0000000003809000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: xVvAobZvWU.exe PID: 2584, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: xVvAobZvWU.exe PID: 5504, type: MEMORY |
Source: Yara match |
File source: 2.2.xVvAobZvWU.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.xVvAobZvWU.exe.39b33b0.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.xVvAobZvWU.exe.39b33b0.2.raw.unpack, type: UNPACKEDPE |