Source: 2.0.O53TFikPkp.exe.400000.6.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.2.O53TFikPkp.exe.4970000.5.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.2.O53TFikPkp.exe.400000.0.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.2.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.5.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.1.O53TFikPkp.exe.400000.0.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.3.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.1.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.4.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: 2.0.O53TFikPkp.exe.400000.8.unpack |
Avira: Label: TR/Spy.Gen8 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00405D7C FindFirstFileA,FindClose, |
1_2_00405D7C |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, |
1_2_004053AA |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00402630 FindFirstFileA, |
1_2_00402630 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00404A29 FindFirstFileExW, |
2_2_00404A29 |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: http://127.0.0.1:HTTP/1.1 |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: http://DynDns.comDynDNS |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: http://UbQjJM.com |
Source: O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.certum |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.certum.pl/ca.crl0h |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.certum.pl/ctnca.crl0k |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925621657.0000000005A90000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0- |
Source: O53TFikPkp.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_Error |
Source: O53TFikPkp.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://repository.certum.pl/ca.cer09 |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://repository.certum.pl/ctnca.cer09 |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925621657.0000000005A90000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://repository.certum.pl/ycasha2.cer0 |
Source: O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://smtp.yandex.com |
Source: O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp |
String found in binary or memory: http://subca.ocsp-certu |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://subca.ocsp-certum.com0. |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://subca.ocsp-certum.com01 |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://www.certum.pl/CPS0 |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925621657.0000000005A90000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925621657.0000000005A90000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: http://yandex.ocsp-responder.com03 |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: https://api.ipify.org% |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: https://api.ipify.org%GETMozilla/5.0 |
Source: O53TFikPkp.exe, 00000002.00000002.924375629.00000000029A5000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924396051.00000000029AD000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.888941433.0000000005151000.00000004.00000001.sdmp |
String found in binary or memory: https://bbTPeNUsMvT4JktW3MN.com |
Source: O53TFikPkp.exe, 00000002.00000003.906856475.0000000005AD6000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905948236.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925666483.0000000005AC2000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.925621657.0000000005A90000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924286996.0000000002981000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000003.905834271.0000000005AD4000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924446366.00000000029C3000.00000004.00000001.sdmp |
String found in binary or memory: https://www.certum.pl/CPS0 |
Source: O53TFikPkp.exe, O53TFikPkp.exe, 00000002.00000000.665781318.0000000000414000.00000040.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924721394.0000000003631000.00000004.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.923912577.00000000025E0000.00000004.00020000.sdmp, O53TFikPkp.exe, 00000002.00000002.922818649.0000000000400000.00000040.00000001.sdmp, O53TFikPkp.exe, 00000002.00000002.924840687.0000000004972000.00000040.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip |
Source: O53TFikPkp.exe, 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp |
String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, |
1_2_00404F61 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, |
1_2_00403225 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0040604C |
1_2_0040604C |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00404772 |
1_2_00404772 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0040A2A5 |
2_2_0040A2A5 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00464840 |
2_2_00464840 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00464C78 |
2_2_00464C78 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00461DD8 |
2_2_00461DD8 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0046EA60 |
2_2_0046EA60 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0046AC20 |
2_2_0046AC20 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00466CB0 |
2_2_00466CB0 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0046C75F |
2_2_0046C75F |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0046C7C0 |
2_2_0046C7C0 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00716138 |
2_2_00716138 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0071F138 |
2_2_0071F138 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00715B01 |
2_2_00715B01 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0071D858 |
2_2_0071D858 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_008CE200 |
2_2_008CE200 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_008C04F6 |
2_2_008C04F6 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_008C8990 |
2_2_008C8990 |
Source: O53TFikPkp.exe, 00000001.00000003.658828325.0000000003276000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000001.00000003.662197259.000000000340F000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000001.00000002.667167111.00000000022B0000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe |
Binary or memory string: OriginalFilename vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000000.665781318.0000000000414000.00000040.00000001.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000002.924721394.0000000003631000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000002.923912577.00000000025E0000.00000004.00020000.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000002.922818649.0000000000400000.00000040.00000001.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000002.924840687.0000000004972000.00000040.00000001.sdmp |
Binary or memory string: OriginalFilenameGHVfffxRlZmplFWkRRUtYKzwxFM.exe4 vs O53TFikPkp.exe |
Source: O53TFikPkp.exe, 00000002.00000002.922757502.0000000000199000.00000004.00000001.sdmp |
Binary or memory string: OriginalFilenameUNKNOWN_FILET vs O53TFikPkp.exe |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00405D7C FindFirstFileA,FindClose, |
1_2_00405D7C |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, |
1_2_004053AA |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_00402630 FindFirstFileA, |
1_2_00402630 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00404A29 FindFirstFileExW, |
2_2_00404A29 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0019E906 mov eax, dword ptr fs:[00000030h] |
1_2_0019E906 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0019E6F2 mov eax, dword ptr fs:[00000030h] |
1_2_0019E6F2 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0019EA34 mov eax, dword ptr fs:[00000030h] |
1_2_0019EA34 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0019E9B7 mov eax, dword ptr fs:[00000030h] |
1_2_0019E9B7 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 1_2_0019E9F6 mov eax, dword ptr fs:[00000030h] |
1_2_0019E9F6 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_004035F1 mov eax, dword ptr fs:[00000030h] |
2_2_004035F1 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00401E1D SetUnhandledExceptionFilter, |
2_2_00401E1D |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
2_2_0040446F |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
2_2_00401C88 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Code function: 2_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
2_2_00401F30 |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\O53TFikPkp.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.25e0000.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.9.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.3635530.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.25e0000.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.6.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.4970000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.3635530.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22c1458.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.8.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22b0000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.415058.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.415058.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22b0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.5646f8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.7.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22c1458.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.9.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.415058.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.5646f8.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.7.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.415058.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000000.665781318.0000000000414000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.924721394.0000000003631000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923015296.0000000000549000.00000004.00000020.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.667167111.00000000022B0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000001.666315289.0000000000414000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000000.665066940.0000000000414000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.924840687.0000000004972000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923912577.00000000025E0000.00000004.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.922818649.0000000000400000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: O53TFikPkp.exe PID: 6712, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: O53TFikPkp.exe PID: 6892, type: MEMORYSTR |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.25e0000.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.9.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.3635530.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.25e0000.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.6.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.4970000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.5.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.400000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.3635530.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22c1458.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.400000.8.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22b0000.4.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.415058.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.415058.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22b0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.5646f8.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.7.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 1.2.O53TFikPkp.exe.22c1458.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.9.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.1.O53TFikPkp.exe.415058.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.5646f8.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.0.O53TFikPkp.exe.415058.7.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.O53TFikPkp.exe.415058.1.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000000.665781318.0000000000414000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.924721394.0000000003631000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923015296.0000000000549000.00000004.00000020.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000001.00000002.667167111.00000000022B0000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000001.666315289.0000000000414000.00000040.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000000.665066940.0000000000414000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.924840687.0000000004972000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923912577.00000000025E0000.00000004.00020000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.922818649.0000000000400000.00000040.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.923951407.0000000002631000.00000004.00000001.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: O53TFikPkp.exe PID: 6712, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: O53TFikPkp.exe PID: 6892, type: MEMORYSTR |