Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_0017DBBE |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0014C2A2 FindFirstFileExW, |
0_2_0014C2A2 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001868EE FindFirstFileW,FindClose, |
0_2_001868EE |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0018698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
0_2_0018698F |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0017D076 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0017D3A9 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00189642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00189642 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0018979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0018979D |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00189B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
0_2_00189B2B |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00185C97 FindFirstFileW,FindNextFileW,FindClose, |
0_2_00185C97 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
4_2_004DDBBE |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004AC2A2 FindFirstFileExW, |
4_2_004AC2A2 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E68EE FindFirstFileW,FindClose, |
4_2_004E68EE |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
4_2_004E698F |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
4_2_004DD076 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
4_2_004DD3A9 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
4_2_004E9642 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
4_2_004E979D |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
4_2_004E9B2B |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E5C97 FindFirstFileW,FindNextFileW,FindClose, |
4_2_004E5C97 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
5_2_00409253 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
5_2_0041C291 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
5_2_0040C34D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
5_2_00409665 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0044E879 FindFirstFileExA, |
5_2_0044E879 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
5_2_0040880C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040783C FindFirstFileW,FindNextFileW, |
5_2_0040783C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
5_2_00419AF5 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
5_2_0040BB30 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
5_2_0040BD37 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
15_2_00409253 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
15_2_0041C291 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
15_2_0040C34D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
15_2_00409665 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0044E879 FindFirstFileExA, |
15_2_0044E879 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
15_2_0040880C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040783C FindFirstFileW,FindNextFileW, |
15_2_0040783C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
15_2_00419AF5 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
15_2_0040BB30 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
15_2_0040BD37 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001A9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_001A9576 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00509576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
4_2_00509576 |
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: Process Memory Space: deblaterate.exe PID: 5276, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 2248, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: deblaterate.exe PID: 1136, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: svchost.exe PID: 592, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: GVV.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
|
Source: GVV.exe, 00000000.00000000.2038475493.00000000001D2000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_fcb6f643-2 |
Source: GVV.exe, 00000000.00000000.2038475493.00000000001D2000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_d3ec8fa3-3 |
Source: GVV.exe, 00000000.00000003.3863279691.0000000003861000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_707dde75-c |
Source: GVV.exe, 00000000.00000003.3863279691.0000000003861000.00000004.00001000.00020000.00000000.sdmp |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_20f5db58-5 |
Source: deblaterate.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
|
Source: deblaterate.exe, 00000004.00000002.3900615657.0000000000532000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_9bf06364-3 |
Source: deblaterate.exe, 00000004.00000002.3900615657.0000000000532000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_275a1e1a-8 |
Source: deblaterate.exe, 0000000E.00000000.4081505385.0000000000532000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_22b7e7e6-5 |
Source: deblaterate.exe, 0000000E.00000000.4081505385.0000000000532000.00000002.00000001.01000000.00000005.sdmp |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_8df6bed2-6 |
Source: GVV.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_48f4790b-8 |
Source: GVV.exe |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_c3aec12a-0 |
Source: deblaterate.exe.0.dr |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_8e876750-1 |
Source: deblaterate.exe.0.dr |
String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_6e140100-6 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00182046 |
0_2_00182046 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00118060 |
0_2_00118060 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00178298 |
0_2_00178298 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0014E4FF |
0_2_0014E4FF |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0014676B |
0_2_0014676B |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001A4873 |
0_2_001A4873 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0013CAA0 |
0_2_0013CAA0 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0011CAF0 |
0_2_0011CAF0 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0012CC39 |
0_2_0012CC39 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00146DD9 |
0_2_00146DD9 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0012B119 |
0_2_0012B119 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001191C0 |
0_2_001191C0 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00131394 |
0_2_00131394 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0013781B |
0_2_0013781B |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00117920 |
0_2_00117920 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0012997D |
0_2_0012997D |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00137A4A |
0_2_00137A4A |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00137CA7 |
0_2_00137CA7 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0019BE44 |
0_2_0019BE44 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00149EEE |
0_2_00149EEE |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_01A83690 |
0_2_01A83690 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0047BF40 |
4_2_0047BF40 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E2046 |
4_2_004E2046 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00478060 |
4_2_00478060 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004D8298 |
4_2_004D8298 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004AE4FF |
4_2_004AE4FF |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004A676B |
4_2_004A676B |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00504873 |
4_2_00504873 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0047CAF0 |
4_2_0047CAF0 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0049CAA0 |
4_2_0049CAA0 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0048CC39 |
4_2_0048CC39 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004A6DD9 |
4_2_004A6DD9 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0048B119 |
4_2_0048B119 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004791C0 |
4_2_004791C0 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00491394 |
4_2_00491394 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0049781B |
4_2_0049781B |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0048997D |
4_2_0048997D |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00477920 |
4_2_00477920 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00497A4A |
4_2_00497A4A |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004C3CD2 |
4_2_004C3CD2 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00497CA7 |
4_2_00497CA7 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004FBE44 |
4_2_004FBE44 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004A9EEE |
4_2_004A9EEE |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_01783690 |
4_2_01783690 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0043E0CC |
5_2_0043E0CC |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0041F0FA |
5_2_0041F0FA |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00454159 |
5_2_00454159 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00438168 |
5_2_00438168 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_004461F0 |
5_2_004461F0 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0043E2FB |
5_2_0043E2FB |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0045332B |
5_2_0045332B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0042739D |
5_2_0042739D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_004374E6 |
5_2_004374E6 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0043E558 |
5_2_0043E558 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00438770 |
5_2_00438770 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_004378FE |
5_2_004378FE |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00433946 |
5_2_00433946 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0044D9C9 |
5_2_0044D9C9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00427A46 |
5_2_00427A46 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0041DB62 |
5_2_0041DB62 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00427BAF |
5_2_00427BAF |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00437D33 |
5_2_00437D33 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00435E5E |
5_2_00435E5E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00426E0E |
5_2_00426E0E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0043DE9D |
5_2_0043DE9D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00413FCA |
5_2_00413FCA |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00436FEA |
5_2_00436FEA |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 14_2_01573690 |
14_2_01573690 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0043E0CC |
15_2_0043E0CC |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0041F0FA |
15_2_0041F0FA |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00454159 |
15_2_00454159 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00438168 |
15_2_00438168 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_004461F0 |
15_2_004461F0 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0043E2FB |
15_2_0043E2FB |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0045332B |
15_2_0045332B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0042739D |
15_2_0042739D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_004374E6 |
15_2_004374E6 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0043E558 |
15_2_0043E558 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00438770 |
15_2_00438770 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_004378FE |
15_2_004378FE |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00433946 |
15_2_00433946 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0044D9C9 |
15_2_0044D9C9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00427A46 |
15_2_00427A46 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0041DB62 |
15_2_0041DB62 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00427BAF |
15_2_00427BAF |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00437D33 |
15_2_00437D33 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00435E5E |
15_2_00435E5E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00426E0E |
15_2_00426E0E |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0043DE9D |
15_2_0043DE9D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00413FCA |
15_2_00413FCA |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00436FEA |
15_2_00436FEA |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: String function: 00130A30 appears 46 times |
|
Source: C:\Users\user\Desktop\GVV.exe |
Code function: String function: 00119CB3 appears 31 times |
|
Source: C:\Users\user\Desktop\GVV.exe |
Code function: String function: 0012F9F2 appears 40 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00402213 appears 38 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 004052FD appears 32 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00434E10 appears 108 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 0040417E appears 46 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00402093 appears 100 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00434770 appears 82 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00401E65 appears 68 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00401FAB appears 38 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00411F67 appears 32 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 004020DF appears 40 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 00457A28 appears 34 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 004484CA appears 36 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 004458D0 appears 56 times |
|
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: String function: 004046F7 appears 34 times |
|
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: String function: 0048F9F2 appears 40 times |
|
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: String function: 00479CB3 appears 31 times |
|
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: String function: 00490A30 appears 46 times |
|
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 4.2.deblaterate.exe.4000000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 15.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 14.2.deblaterate.exe.3e00000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 4.2.deblaterate.exe.4000000.1.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 15.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 5.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 5.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 14.2.deblaterate.exe.3e00000.1.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 00000004.00000002.3901211250.0000000004000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0000000E.00000002.4105973198.0000000003E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0000000F.00000002.4490357990.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 00000005.00000002.4071719764.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: Process Memory Space: deblaterate.exe PID: 5276, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 2248, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: deblaterate.exe PID: 1136, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: svchost.exe PID: 592, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sxs.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: vbscript.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: scrobj.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mlang.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: scrrun.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0012F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_0012F98E |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001A1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
0_2_001A1C41 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0048F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
4_2_0048F98E |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00501C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
4_2_00501C41 |
Source: C:\Users\user\Desktop\GVV.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WerFault.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\wscript.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\svchost.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_0017DBBE |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0014C2A2 FindFirstFileExW, |
0_2_0014C2A2 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001868EE FindFirstFileW,FindClose, |
0_2_001868EE |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0018698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
0_2_0018698F |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0017D076 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0017D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_0017D3A9 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00189642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00189642 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0018979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_0018979D |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00189B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
0_2_00189B2B |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00185C97 FindFirstFileW,FindNextFileW,FindClose, |
0_2_00185C97 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, |
4_2_004DDBBE |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004AC2A2 FindFirstFileExW, |
4_2_004AC2A2 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E68EE FindFirstFileW,FindClose, |
4_2_004E68EE |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, |
4_2_004E698F |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
4_2_004DD076 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
4_2_004DD3A9 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
4_2_004E9642 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
4_2_004E979D |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, |
4_2_004E9B2B |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004E5C97 FindFirstFileW,FindNextFileW,FindClose, |
4_2_004E5C97 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
5_2_00409253 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
5_2_0041C291 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
5_2_0040C34D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
5_2_00409665 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0044E879 FindFirstFileExA, |
5_2_0044E879 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
5_2_0040880C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040783C FindFirstFileW,FindNextFileW, |
5_2_0040783C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
5_2_00419AF5 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
5_2_0040BB30 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
5_2_0040BD37 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
15_2_00409253 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
15_2_0041C291 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
15_2_0040C34D |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
15_2_00409665 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0044E879 FindFirstFileExA, |
15_2_0044E879 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
15_2_0040880C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040783C FindFirstFileW,FindNextFileW, |
15_2_0040783C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
15_2_00419AF5 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
15_2_0040BB30 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
15_2_0040BD37 |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual USB Mouse |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.syshbin |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware, Inc. |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware20,1hbin@ |
Source: Amcache.hve.9.dr |
Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563 |
Source: Amcache.hve.9.dr |
Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.9.dr |
Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20 |
Source: svchost.exe, 00000005.00000002.4072031610.0000000002C71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.4119768647.0000000002E67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490908673.0000000002E8E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490805278.0000000002E67000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW |
Source: Amcache.hve.9.dr |
Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: svchost.exe, 00000005.00000002.4072003934.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Hyper-V RAW( |
Source: Amcache.hve.9.dr |
Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev |
Source: Amcache.hve.9.dr |
Binary or memory string: c:/windows/system32/drivers/vmci.sys |
Source: wscript.exe, 0000000D.00000002.4082499964.000001E7162A4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\AZR |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000 |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.sys |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.syshbin` |
Source: wscript.exe, 0000000D.00000002.4082499964.000001E7162A4000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61c+'d |
Source: Amcache.hve.9.dr |
Binary or memory string: \driver\vmci,\driver\pci |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000 |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware20,1 |
Source: Amcache.hve.9.dr |
Binary or memory string: Microsoft Hyper-V Generation Counter |
Source: Amcache.hve.9.dr |
Binary or memory string: NECVMWar VMware SATA CD00 |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual disk SCSI Disk Device |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom |
Source: Amcache.hve.9.dr |
Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk |
Source: Amcache.hve.9.dr |
Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware PCI VMCI Bus Device |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware VMCI Bus Device |
Source: Amcache.hve.9.dr |
Binary or memory string: VMware Virtual RAM |
Source: Amcache.hve.9.dr |
Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1 |
Source: Amcache.hve.9.dr |
Binary or memory string: vmci.inf_amd64_68ed49469341f563 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00142622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_00142622 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_0013083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
0_2_0013083F |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_001309D5 SetUnhandledExceptionFilter, |
0_2_001309D5 |
Source: C:\Users\user\Desktop\GVV.exe |
Code function: 0_2_00130C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
0_2_00130C21 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
4_2_004A2622 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_0049083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
4_2_0049083F |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_004909D5 SetUnhandledExceptionFilter, |
4_2_004909D5 |
Source: C:\Users\user\AppData\Local\silvexes\deblaterate.exe |
Code function: 4_2_00490C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
4_2_00490C21 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
5_2_004349F9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00434B47 SetUnhandledExceptionFilter, |
5_2_00434B47 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
5_2_0043BB22 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 5_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
5_2_00434FDC |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
15_2_004349F9 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00434B47 SetUnhandledExceptionFilter, |
15_2_00434B47 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, |
15_2_0043BB22 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: 15_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, |
15_2_00434FDC |
Source: GVV.exe, deblaterate.exe.0.dr |
Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning |
Source: svchost.exe, 00000005.00000002.4072003934.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490784851.0000000002E31000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program Manager |
Source: GVV.exe, deblaterate.exe |
Binary or memory string: Shell_TrayWnd |
Source: svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program ManagerOS\ |
Source: svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: yuahdgbceja.sytes.net:2766:1Program Managerhttp://geoplugin.net/json.gp |
Source: svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: Program ManagerOS\cf |
Source: svchost.exe, 00000005.00000002.4072031610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.4072003934.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490748078.0000000002E12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: |Program Manager| |
Source: svchost.exe, 00000005.00000002.4072003934.0000000002C12000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: LRPC-8bd2641bc1c3c300cfProgram Manager1oftware |
Source: svchost.exe, 00000005.00000002.4072031610.0000000002C31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.4072031610.0000000002C65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4490805278.0000000002E54000.00000004.00000020.00020000.00000000.sdmp |
Binary or memory string: [Program Manager] |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoA, |
5_2_0040F8D1 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
5_2_00452036 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
5_2_004520C3 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
5_2_00452313 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
5_2_00448404 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
5_2_0045243C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
5_2_00452543 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
5_2_00452610 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
5_2_004488ED |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, |
5_2_00451CD8 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
5_2_00451F50 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
5_2_00451F9B |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoA, |
15_2_0040F8D1 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
15_2_00452036 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, |
15_2_004520C3 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
15_2_00452313 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
15_2_00448404 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, |
15_2_0045243C |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
15_2_00452543 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, |
15_2_00452610 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: GetLocaleInfoW, |
15_2_004488ED |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, |
15_2_00451CD8 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
15_2_00451F50 |
Source: C:\Windows\SysWOW64\svchost.exe |
Code function: EnumSystemLocalesW, |
15_2_00451F9B |