Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
DNS query: name: api.ipify.org |
Source: CasPol.exe, 00000001.00000002.560208417.0000000006262000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://discord.com |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.ipify.org |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://api.ipify.org/ |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://discord.com |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://discord.com/api/webhooks/1063267560818233445/Ga1uL1m9HE258QH4hqiVhVH5m98lA3rsO835awvMXcR1F31 |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://discord.com4Dp |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D90764 |
0_2_00007FF9A5D90764 |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D96CAD |
0_2_00007FF9A5D96CAD |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D90816 |
0_2_00007FF9A5D90816 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A3C5B0 |
1_2_05A3C5B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A317A0 |
1_2_05A317A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A31772 |
1_2_05A31772 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A301A0 |
1_2_05A301A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A39328 |
1_2_05A39328 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06B90D20 |
1_2_06B90D20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06B99DF0 |
1_2_06B99DF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06F442D0 |
1_2_06F442D0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06F4E088 |
1_2_06F4E088 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06F4B178 |
1_2_06F4B178 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06F47C08 |
1_2_06F47C08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06F48BC0 |
1_2_06F48BC0 |
Source: e-dekont-20230206.exe, 00000000.00000000.291653847.0000022E8D92C000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenameNNbHhH.exe. vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameFUCKYOU.dll0 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamec4a5f7b8-6b1b-4e41-a389-a4734cc6954b.exe4 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296795377.0000022E9F6E9000.00000004.00000800.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamec4a5f7b8-6b1b-4e41-a389-a4734cc6954b.exe4 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp |
Binary or memory string: OriginalFilenameFUCKYOU.dll0 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.295935631.0000022E8D9D9000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameclr.dllT vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe |
Binary or memory string: OriginalFilenameNNbHhH.exe. vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
Cryptographic APIs: 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs |
Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs |
Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs |
Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: e-dekont-20230206.exe, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs |
.Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs |
.Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs |
.Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
.Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
.Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
.Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D9826D push edi; retf |
0_2_00007FF9A5D9826E |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D9821E push edi; retf |
0_2_00007FF9A5D9821F |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D9890E push eax; retf |
0_2_00007FF9A5D9890F |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Code function: 0_2_00007FF9A5D9841A push ebp; retf |
0_2_00007FF9A5D9841B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A37C9A push eax; retf |
1_2_05A37CA1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A37499 push FFFFFF8Bh; iretd |
1_2_05A3749E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A37CE0 pushfd ; retf |
1_2_05A37CE1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A38424 push esp; iretd |
1_2_05A38829 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A337B7 pushad ; iretd |
1_2_05A337F9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_05A37E40 push 6C66h; ret |
1_2_05A37E5A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Code function: 1_2_06B9CF26 push es; retf |
1_2_06B9CF2C |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs |
High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe TID: 2216 |
Thread sleep time: -922337203685477s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5604 |
Thread sleep count: 9564 > 30 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -18446744073709540s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1200000s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199781s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199422s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199297s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199167s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1199015s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198906s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198797s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198531s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198404s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198279s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198171s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1198041s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197921s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197813s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197496s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197390s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197264s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197156s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1197031s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196922s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196813s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196641s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196510s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196406s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196288s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196171s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1196063s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195953s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195844s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195703s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195593s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195484s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195374s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195265s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195155s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1195042s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194922s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194812s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194703s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194593s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194483s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194375s >= -30000s |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 |
Thread sleep time: -1194263s >= -30000s |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1200000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199781 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199422 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199297 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199167 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199015 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198906 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198797 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198531 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198404 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198279 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198171 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198041 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197921 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197496 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197390 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197264 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197156 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197031 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196922 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196510 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196406 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196288 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196171 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196063 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195953 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195844 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195593 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195484 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195374 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195265 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195155 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195042 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194922 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194812 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194593 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194483 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194375 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194263 |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1200000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199781 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199422 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199297 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199167 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1199015 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198906 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198797 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198531 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198404 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198279 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198171 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1198041 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197921 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197496 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197390 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197264 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197156 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1197031 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196922 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196813 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196641 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196510 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196406 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196288 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196171 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1196063 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195953 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195844 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195593 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195484 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195374 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195265 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195155 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1195042 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194922 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194812 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194703 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194593 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194483 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194375 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Thread delayed: delay time: 1194263 |
Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe |
Queries volume information: C:\Users\user\Desktop\e-dekont-20230206.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |