Source: | Binary string: FUCKYOU.pdb source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp, e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp |
Source: | Binary string: FUCKYOU.pdbxc source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp, e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp |
Source: | Binary string: NNbHhH.pdb source: e-dekont-20230206.exe |
Source: | Binary string: NNbHhH.pdbH source: e-dekont-20230206.exe |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | DNS query: name: api.ipify.org |
Source: CasPol.exe, 00000001.00000002.560208417.0000000006262000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://discord.com |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.ipify.org |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.ipify.org/ |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://discord.com |
Source: CasPol.exe, 00000001.00000002.558103667.0000000003391000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://discord.com/api/webhooks/1063267560818233445/Ga1uL1m9HE258QH4hqiVhVH5m98lA3rsO835awvMXcR1F31 |
Source: CasPol.exe, 00000001.00000002.558103667.00000000033F4000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://discord.com4Dp |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D90764 | 0_2_00007FF9A5D90764 |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D96CAD | 0_2_00007FF9A5D96CAD |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D90816 | 0_2_00007FF9A5D90816 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A3C5B0 | 1_2_05A3C5B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A317A0 | 1_2_05A317A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A31772 | 1_2_05A31772 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A301A0 | 1_2_05A301A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A39328 | 1_2_05A39328 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06B90D20 | 1_2_06B90D20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06B99DF0 | 1_2_06B99DF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06F442D0 | 1_2_06F442D0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06F4E088 | 1_2_06F4E088 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06F4B178 | 1_2_06F4B178 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06F47C08 | 1_2_06F47C08 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06F48BC0 | 1_2_06F48BC0 |
Source: e-dekont-20230206.exe, 00000000.00000000.291653847.0000022E8D92C000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameNNbHhH.exe. vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameFUCKYOU.dll0 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamec4a5f7b8-6b1b-4e41-a389-a4734cc6954b.exe4 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296795377.0000022E9F6E9000.00000004.00000800.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamec4a5f7b8-6b1b-4e41-a389-a4734cc6954b.exe4 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp | Binary or memory string: OriginalFilenameFUCKYOU.dll0 vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, 00000000.00000002.295935631.0000022E8D9D9000.00000004.00000020.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameclr.dllT vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe | Binary or memory string: OriginalFilenameNNbHhH.exe. vs e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | Cryptographic APIs: 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs | Cryptographic APIs: 'TransformFinalBlock' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs | Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs | Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: 1.2.CasPol.exe.400000.0.unpack, A/N1.cs | Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: | Binary string: FUCKYOU.pdb source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp, e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp |
Source: | Binary string: FUCKYOU.pdbxc source: e-dekont-20230206.exe, 00000000.00000002.296544306.0000022E8F6E1000.00000004.00000800.00020000.00000000.sdmp, e-dekont-20230206.exe, 00000000.00000002.296374336.0000022E8DC30000.00000004.08000000.00040000.00000000.sdmp |
Source: | Binary string: NNbHhH.pdb source: e-dekont-20230206.exe |
Source: | Binary string: NNbHhH.pdbH source: e-dekont-20230206.exe |
Source: e-dekont-20230206.exe, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs | .Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs | .Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, SdRVZOuA41VO3Qkhg8/Hbk6J2G275BdoJl0CG.cs | .Net Code: xxNjTM0rD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | .Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | .Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | .Net Code: stackVariable6.GetMethod("GetDelegateForFunctionPointer", V_0) |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D9826D push edi; retf | 0_2_00007FF9A5D9826E |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D9821E push edi; retf | 0_2_00007FF9A5D9821F |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D9890E push eax; retf | 0_2_00007FF9A5D9890F |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Code function: 0_2_00007FF9A5D9841A push ebp; retf | 0_2_00007FF9A5D9841B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A37C9A push eax; retf | 1_2_05A37CA1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A37499 push FFFFFF8Bh; iretd | 1_2_05A3749E |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A37CE0 pushfd ; retf | 1_2_05A37CE1 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A38424 push esp; iretd | 1_2_05A38829 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A337B7 pushad ; iretd | 1_2_05A337F9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_05A37E40 push 6C66h; ret | 1_2_05A37E5A |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Code function: 1_2_06B9CF26 push es; retf | 1_2_06B9CF2C |
Source: e-dekont-20230206.exe, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: 0.2.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: 0.0.e-dekont-20230206.exe.22e8d880000.0.unpack, WHFDtbAvAuefNBieNZ/MBloaf2FamTksiyQF0.cs | High entropy of concatenated method names: '.cctor', 'DoLrRC2aiV2ty', 'jKwJEdlLh', 'nIjkqkxau', 'l3W9dARdo', 'UOsUD22g2', 'ccEEpyD4X', 'YloYafFam', 'WksgiyQF0', 'WHFyDtbvA' |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe TID: 2216 | Thread sleep time: -922337203685477s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5604 | Thread sleep count: 9564 > 30 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -18446744073709540s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1200000s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199781s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199641s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199422s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199297s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199167s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1199015s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198906s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198797s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198641s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198531s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198404s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198279s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198171s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1198041s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197921s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197813s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197641s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197496s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197390s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197264s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197156s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1197031s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196922s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196813s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196641s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196510s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196406s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196288s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196171s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1196063s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195953s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195844s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195703s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195593s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195484s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195374s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195265s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195155s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1195042s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194922s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194812s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194703s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194593s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194483s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194375s >= -30000s | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5584 | Thread sleep time: -1194263s >= -30000s | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1200000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199781 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199422 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199297 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199167 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199015 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198906 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198797 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198531 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198404 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198279 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198041 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197921 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197496 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197390 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197264 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197156 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197031 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196922 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196510 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196406 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196288 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195953 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195844 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195593 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195484 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195374 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195265 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195155 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195042 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194922 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194812 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194593 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194483 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194375 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194263 | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1200000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199781 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199422 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199297 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199167 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1199015 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198906 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198797 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198531 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198404 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198279 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1198041 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197921 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197496 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197390 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197264 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197156 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1197031 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196922 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196813 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196510 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196406 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196288 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1196063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195953 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195844 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195593 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195484 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195374 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195265 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195155 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1195042 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194922 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194812 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194703 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194593 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194483 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194375 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Thread delayed: delay time: 1194263 | Jump to behavior |
Source: C:\Users\user\Desktop\e-dekont-20230206.exe | Queries volume information: C:\Users\user\Desktop\e-dekont-20230206.exe VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation | Jump to behavior |