Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
7_2_100010F1 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_10006580 FindFirstFileExA, |
7_2_10006580 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_00409253 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
12_2_0041C291 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
12_2_0040C34D |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_00409665 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0044E879 FindFirstFileExA, |
12_2_0044E879 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
12_2_0040880C |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040783C FindFirstFileW,FindNextFileW, |
12_2_0040783C |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
12_2_00419AF5 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
12_2_0040BB30 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
12_2_0040BD37 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0040AE51 FindFirstFileW,FindNextFileW, |
15_2_0040AE51 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen, |
17_2_00407EF8 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen, |
20_2_00407898 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.120.235.122 |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0 |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07 |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0 |
Source: proof of payment.exe, 00000007.00000002.3915851761.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, NvbYSEq.exe |
String found in binary or memory: http://geoplugin.net/json.gp |
Source: proof of payment.exe, 00000000.00000002.1502678192.000000000389E000.00000004.00000800.00020000.00000000.sdmp, NvbYSEq.exe, 00000008.00000002.1540918015.0000000003854000.00000004.00000800.00020000.00000000.sdmp, NvbYSEq.exe, 00000008.00000002.1540918015.0000000003837000.00000004.00000800.00020000.00000000.sdmp, NvbYSEq.exe, 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp |
String found in binary or memory: http://geoplugin.net/json.gp/C |
Source: proof of payment.exe, 00000007.00000002.3915851761.00000000015B5000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://geoplugin.net/json.gp2 |
Source: proof of payment.exe, 00000007.00000002.3915851761.00000000015B5000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://geoplugin.net/json.gpOw |
Source: proof of payment.exe, 00000007.00000002.3915851761.00000000015B5000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://geoplugin.net/json.gp_ |
Source: bhv58.tmp.15.dr |
String found in binary or memory: http://ocsp.digicert.com0 |
Source: proof of payment.exe, 00000000.00000002.1499485685.0000000002661000.00000004.00000800.00020000.00000000.sdmp, NvbYSEq.exe, 00000008.00000002.1538465921.0000000002648000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: proof of payment.exe, proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://www.ebuddy.com |
Source: proof of payment.exe, proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://www.imvu.com |
Source: proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com |
Source: proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://www.imvu.comr |
Source: proof of payment.exe, 0000000F.00000002.1695925897.00000000009C4000.00000004.00000010.00020000.00000000.sdmp |
String found in binary or memory: http://www.nirsoft.net |
Source: proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: http://www.nirsoft.net/ |
Source: proof of payment.exe, 0000000F.00000002.1696807471.00000000010BD000.00000004.00000020.00020000.00000000.sdmp, proof of payment.exe, 0000000F.00000002.1696448109.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com: |
Source: proof of payment.exe, 0000000F.00000002.1696448109.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033 |
Source: proof of payment.exe, 0000000F.00000002.1696448109.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/oauth20_desktop.srfLMEM |
Source: proof of payment.exe, 0000000F.00000002.1696448109.0000000000CDE000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live |
Source: proof of payment.exe |
String found in binary or memory: https://login.yahoo.com/config/login |
Source: proof of payment.exe, proof of payment.exe, 00000014.00000002.1689804255.0000000000400000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://www.google.com |
Source: proof of payment.exe |
String found in binary or memory: https://www.google.com/accounts/servicelogin |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 8.2.NvbYSEq.exe.3858820.4.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 8.2.NvbYSEq.exe.3858820.4.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.2.proof of payment.exe.3917800.3.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.proof of payment.exe.3917800.3.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 0.2.proof of payment.exe.389ebe0.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0.2.proof of payment.exe.389ebe0.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000008.00000002.1540918015.0000000003837000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Author: unknown |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen |
Source: 00000008.00000002.1540918015.0000000003854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: 00000000.00000002.1502678192.000000000389E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: proof of payment.exe PID: 2228, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: NvbYSEq.exe PID: 4984, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: Process Memory Space: NvbYSEq.exe PID: 6596, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 0_2_00D5DCD4 |
0_2_00D5DCD4 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_10017194 |
7_2_10017194 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_1000B5C1 |
7_2_1000B5C1 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_00C5DCD4 |
8_2_00C5DCD4 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_04B57118 |
8_2_04B57118 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_04B50006 |
8_2_04B50006 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_04B50040 |
8_2_04B50040 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_04B57109 |
8_2_04B57109 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_06860007 |
8_2_06860007 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_06863EE7 |
8_2_06863EE7 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_06863EF8 |
8_2_06863EF8 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 8_2_069140E0 |
8_2_069140E0 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0043E0CC |
12_2_0043E0CC |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0041F0FA |
12_2_0041F0FA |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00454159 |
12_2_00454159 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00438168 |
12_2_00438168 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_004461F0 |
12_2_004461F0 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0043E2FB |
12_2_0043E2FB |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0045332B |
12_2_0045332B |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0042739D |
12_2_0042739D |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_004374E6 |
12_2_004374E6 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0043E558 |
12_2_0043E558 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00438770 |
12_2_00438770 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_004378FE |
12_2_004378FE |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00433946 |
12_2_00433946 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0044D9C9 |
12_2_0044D9C9 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00427A46 |
12_2_00427A46 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0041DB62 |
12_2_0041DB62 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00427BAF |
12_2_00427BAF |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00437D33 |
12_2_00437D33 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00435E5E |
12_2_00435E5E |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00426E0E |
12_2_00426E0E |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0043DE9D |
12_2_0043DE9D |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00413FCA |
12_2_00413FCA |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00436FEA |
12_2_00436FEA |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044B040 |
15_2_0044B040 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0043610D |
15_2_0043610D |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00447310 |
15_2_00447310 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044A490 |
15_2_0044A490 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0040755A |
15_2_0040755A |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0043C560 |
15_2_0043C560 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044B610 |
15_2_0044B610 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044D6C0 |
15_2_0044D6C0 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_004476F0 |
15_2_004476F0 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044B870 |
15_2_0044B870 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044081D |
15_2_0044081D |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00414957 |
15_2_00414957 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_004079EE |
15_2_004079EE |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00407AEB |
15_2_00407AEB |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044AA80 |
15_2_0044AA80 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00412AA9 |
15_2_00412AA9 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00404B74 |
15_2_00404B74 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00404B03 |
15_2_00404B03 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0044BBD8 |
15_2_0044BBD8 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00404BE5 |
15_2_00404BE5 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00404C76 |
15_2_00404C76 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00415CFE |
15_2_00415CFE |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00416D72 |
15_2_00416D72 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00446D30 |
15_2_00446D30 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00446D8B |
15_2_00446D8B |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_00406E8F |
15_2_00406E8F |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00405038 |
17_2_00405038 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0041208C |
17_2_0041208C |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_004050A9 |
17_2_004050A9 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0040511A |
17_2_0040511A |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0043C13A |
17_2_0043C13A |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_004051AB |
17_2_004051AB |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00449300 |
17_2_00449300 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0040D322 |
17_2_0040D322 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0044A4F0 |
17_2_0044A4F0 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0043A5AB |
17_2_0043A5AB |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00413631 |
17_2_00413631 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00446690 |
17_2_00446690 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0044A730 |
17_2_0044A730 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_004398D8 |
17_2_004398D8 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_004498E0 |
17_2_004498E0 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0044A886 |
17_2_0044A886 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0043DA09 |
17_2_0043DA09 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00438D5E |
17_2_00438D5E |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00449ED0 |
17_2_00449ED0 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_0041FE83 |
17_2_0041FE83 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00430F54 |
17_2_00430F54 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_004050C2 |
20_2_004050C2 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_004014AB |
20_2_004014AB |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00405133 |
20_2_00405133 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_004051A4 |
20_2_004051A4 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00401246 |
20_2_00401246 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_0040CA46 |
20_2_0040CA46 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00405235 |
20_2_00405235 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_004032C8 |
20_2_004032C8 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00401689 |
20_2_00401689 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00402F60 |
20_2_00402F60 |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.2.proof of payment.exe.3917800.3.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.NvbYSEq.exe.400000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 12.2.NvbYSEq.exe.400000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 8.2.NvbYSEq.exe.37dfc00.3.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0.2.proof of payment.exe.389ebe0.2.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 8.2.NvbYSEq.exe.3858820.4.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 8.2.NvbYSEq.exe.3858820.4.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 8.2.NvbYSEq.exe.3858820.4.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.2.proof of payment.exe.3917800.3.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.proof of payment.exe.3917800.3.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 0.2.proof of payment.exe.389ebe0.2.raw.unpack, type: UNPACKEDPE |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0.2.proof of payment.exe.389ebe0.2.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000008.00000002.1540918015.0000000003837000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda |
Source: 0000000C.00000002.1517046290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
Source: 00000008.00000002.1540918015.0000000003854000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: 00000000.00000002.1502678192.000000000389E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: proof of payment.exe PID: 2228, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: NvbYSEq.exe PID: 4984, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: Process Memory Space: NvbYSEq.exe PID: 6596, type: MEMORYSTR |
Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23 |
Source: unknown |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NvbYSEq.exe" |
|
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpCCF4.tmp" |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" |
|
Source: unknown |
Process created: C:\Users\user\AppData\Roaming\NvbYSEq.exe C:\Users\user\AppData\Roaming\NvbYSEq.exe |
|
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding |
|
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpE166.tmp" |
|
Source: C:\Windows\SysWOW64\schtasks.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process created: C:\Users\user\AppData\Roaming\NvbYSEq.exe "C:\Users\user\AppData\Roaming\NvbYSEq.exe" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\uevjjogtpiaq" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NvbYSEq.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpCCF4.tmp" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\uevjjogtpiaq" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process created: C:\Users\user\Desktop\proof of payment.exe "C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx" |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpE166.tmp" |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process created: C:\Users\user\AppData\Roaming\NvbYSEq.exe "C:\Users\user\AppData\Roaming\NvbYSEq.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: atl.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: msisip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wshext.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: appxsip.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: opcservices.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: secur32.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: microsoft.management.infrastructure.native.unmanaged.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wmidcom.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: mswsock.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: ondemandconnroutehelper.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: winhttp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: winnsi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: dnsapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rasadhlp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: fwpuclnt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: vcruntime140_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: ucrtbase_clr0400.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: dwrite.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: amsi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: windowscodecs.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: edputil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: windows.staterepositoryps.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: appresolver.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: bcp47langs.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: slc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: sppc.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: onecorecommonproxystub.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: onecoreuapcommonproxystub.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: fastprox.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: ncobjapi.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wbemcomn.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: mpclient.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: wmitomi.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: mi.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: miutils.dll |
Jump to behavior |
Source: C:\Windows\System32\wbem\WmiPrvSE.exe |
Section loaded: gpapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: taskschd.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\schtasks.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: urlmon.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: srvcli.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: netutils.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: rstrtmgr.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: ncrypt.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: ntasn1.dll |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sspicli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: iertutil.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: pstorec.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: vaultcli.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: dpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: msasn1.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: pstorec.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: windows.storage.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: wldp.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: msasn1.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: sspicli.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptsp.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: rsaenh.dll |
|
Source: C:\Users\user\Desktop\proof of payment.exe |
Section loaded: cryptbase.dll |
|
Source: 0.2.proof of payment.exe.5130000.6.raw.unpack, XG.cs |
High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, O04JbMpW67PNEoiq0y.cs |
High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LFnreChvBM', 'qc9rFHbpxX', 'EFMrz9uWvg', 'BcUT8VKtCk', 'pNaT7QbYeb', 'gELTr0RMka', 'nonTTNEExw', 'JKqTCRtT02uAYJPq4DQ' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, KgSR3u8nGBA1sLZNNP.cs |
High entropy of concatenated method names: 'P3kSxguUdE', 'rrfS3P41Lg', 'HtWVcnAS2h', 'vruVqTjcr6', 'juvVmxsd82', 'EVcVw6TC5x', 'b4gVdPOK25', 'olRV59jdO9', 'U3cV1JFlpf', 'fj9Vl0ddoF' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, woM7QtlW1bUYg1UktQ.cs |
High entropy of concatenated method names: 'Dispose', 'Igf7eh15cC', 'dHLrtBkvqb', 'hvSii582gn', 'iui7Fc4kqI', 'nXH7z6UCLr', 'ProcessDialogKey', 'cfhr86d3tt', 'HFwr7YmbAM', 'xunrrPcb5R' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, qGDm8F0vo4f3CaqRJ8.cs |
High entropy of concatenated method names: 'c78HLgHUJD', 'OBcHak649G', 'HxgHShtAgg', 'D7AH03dKoM', 'RU2HDuDAkb', 'r8fSy1OZPp', 'ld3SCkaKsE', 'dqZSE4uAIY', 'sVjSJL2H0w', 'fGRSe1Mo6S' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, WHxJ2tyopBTMyOacdk.cs |
High entropy of concatenated method names: 'kc60OmF2oo', 'qQv0WULlM8', 'NDL02FH5fP', 'HSm0BrfdRb', 'Hpe0xmPnWd', 'Ywq0vpPw6W', 'juF03HXE3f', 'fBJ0genqfJ', 'y6L0U7JlFI', 'dDt04ixvVE' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, eoECqEoP1MV499hB3G.cs |
High entropy of concatenated method names: 'ToString', 'wheGQdrMV0', 'X8oGt9PNmQ', 'cB2GcFGSZO', 'MGBGqIH73k', 'qraGmQh86Y', 'HotGwQikvy', 'T9JGd1uxqQ', 'NvXG5d7waa', 'ip6G1ABwCa' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, j4jqMnwViZQb4cRVS7.cs |
High entropy of concatenated method names: 'C9HVBUcx40', 'CkBVvXsIr4', 'EiFVg3cDwC', 'l7qVU2qi0a', 'tomVsRKk2M', 'VFSVGX4w9O', 'PYpVpv8PZb', 'FjLVXSkC6V', 'EyMVKJyQx1', 'WeGVh5xc7G' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, R0k6N6vsjjBavB4q3V.cs |
High entropy of concatenated method names: 'd8EfglaEhg', 'DPqfUINGbJ', 'F9qf9Niwtu', 'dT3ftUcLhm', 'XMHfqEONFQ', 'fwRfmkUYMa', 'tIPfdNk927', 'egTf5HkCwQ', 'hd6flQi1gS', 'YOVfQJ8A9a' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, ijAOQ7mRGBRMsxXAQS.cs |
High entropy of concatenated method names: 'id80MrVhlr', 'fsw0VIEihp', 'qC50HAu48f', 'SbtHFc2cwO', 'TSoHzCf1XE', 'cjl08o6SaB', 'UMb07Xp8jK', 'B3K0raOfa1', 'UVw0T6ZRnD', 'o6D0jMNDxJ' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, m27lXb6r4MZHCO3jU8.cs |
High entropy of concatenated method names: 'Sih2OOCtM', 'n52BO9bSD', 'b8RvG7YEC', 'JXZ30KgVr', 'rssU2I0M5', 'rWO4W2Hc1', 'zDuv7tNsEPTgry2KMo', 'C5w0yhE86TSUGIafMT', 'UZGX8cNuO', 'g2XhkjOhy' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, NmD84IhXqX5T6TEkV6.cs |
High entropy of concatenated method names: 'wCHpJPJyR0', 'sxRpFvTw8H', 'eJMX8bKCu2', 'fUQX79yjrG', 'VZUpQaEvUO', 'x3opPsGdNj', 'xy0pALit6q', 'WV5pRXljyr', 'OxCpZLEIc9', 'cOPpnkgyns' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, F2PTqtdykfFUcIb56j.cs |
High entropy of concatenated method names: 'AYgX9KKbxn', 'IqJXtfDiRt', 'UREXcWxQJf', 'VvfXqHxDDH', 'EYjXREkAOI', 'IjNXmuPgeM', 'Next', 'Next', 'Next', 'NextBytes' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, lCRMA5DlhXbJjo7mgP.cs |
High entropy of concatenated method names: 'XOUK7fOCGk', 'eBtKTbHBlE', 'GNrKjjqQYp', 'mniKMCNMTC', 'HkgKaTcPaL', 's5bKSBPZ9g', 'G7kKHQUQjE', 't64XE23Zn0', 'mkBXJjYgka', 'DVXXeBXhbW' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, pr8Do41Q1tqFwxoK05.cs |
High entropy of concatenated method names: 'eWBTLXt3er', 'iOtTMlUF5l', 'OQ4TaT1ZsC', 'VibTVbpR7H', 'ADVTS4dCv0', 'KadTHMkTAy', 'vNhT0qwQbT', 'VZtTD7HKkP', 'dxpTIOGC08', 'qQHTu998oi' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, rhi5WUbqRqYWJ4I5aL.cs |
High entropy of concatenated method names: 'gXhpu9v1k5', 'OIqpkIdKxY', 'ToString', 'De3pMtqr5e', 'eIlpa4KGgS', 'jRTpVokqo0', 'LYEpSmeS0j', 'ALqpH6LbN9', 'vosp0ysL2B', 'wmRpDn8t0K' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, CmapgpqkNF7N5qJ90ud.cs |
High entropy of concatenated method names: 'alqKOrJ0pj', 'og8KWuXd29', 'iIAK2rCVFe', 'GWTKBUdRp1', 'UwMKx4rRBo', 'RDHKvT0qhU', 'fjHK3v12CM', 'cmdKgBShHa', 'YhIKUBFLmT', 'JmNK404BNS' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, HZasU9nsywqiKFgaDv.cs |
High entropy of concatenated method names: 'onQaRYYxBE', 'IM2aZtghIN', 'RpFanjrrNu', 'sIka6VaZwU', 'BavayUICgv', 'PdAaCMI85I', 'KmEaES8IZt', 'nKraJ28955', 'opkaew46xI', 'K1xaFe1Yc2' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, t3dR5NEyPQ0BnbAjPf.cs |
High entropy of concatenated method names: 'KNHXMolEP8', 'MFVXaqPpuS', 'APNXVJBc3n', 'bE9XSoGTZE', 'uoYXHO6fxn', 'AYZX0iFBhY', 'OGvXD9JRVh', 'dHcXIGfsdW', 'TIpXufgcOF', 'wufXkDqp0f' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, zUd261zcGb9YwcjLSm.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UUtKfeexau', 'QuMKsB0qwN', 'vbwKGbQ8Rm', 'GC9KpQCDUY', 'qhYKX3mUHu', 't4TKKjEyun', 'v3iKhbT2Un' |
Source: 0.2.proof of payment.exe.6a30000.7.raw.unpack, ir4OiiaLqZUjSaiS1D.cs |
High entropy of concatenated method names: 'BPZ70EqBf8', 'Iso7D7DIGj', 'mON7u8pSmB', 'otW7kHJ1EU', 'Nph7snNx7b', 'N7o7Gd9CgL', 'YWb0Zj1DxBQUSZDFr5', 'd0DGejsIX4gCSvvaDM', 'gTr77yfym1', 'fiq7TWyUCH' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, O04JbMpW67PNEoiq0y.cs |
High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'LFnreChvBM', 'qc9rFHbpxX', 'EFMrz9uWvg', 'BcUT8VKtCk', 'pNaT7QbYeb', 'gELTr0RMka', 'nonTTNEExw', 'JKqTCRtT02uAYJPq4DQ' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, KgSR3u8nGBA1sLZNNP.cs |
High entropy of concatenated method names: 'P3kSxguUdE', 'rrfS3P41Lg', 'HtWVcnAS2h', 'vruVqTjcr6', 'juvVmxsd82', 'EVcVw6TC5x', 'b4gVdPOK25', 'olRV59jdO9', 'U3cV1JFlpf', 'fj9Vl0ddoF' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, woM7QtlW1bUYg1UktQ.cs |
High entropy of concatenated method names: 'Dispose', 'Igf7eh15cC', 'dHLrtBkvqb', 'hvSii582gn', 'iui7Fc4kqI', 'nXH7z6UCLr', 'ProcessDialogKey', 'cfhr86d3tt', 'HFwr7YmbAM', 'xunrrPcb5R' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, qGDm8F0vo4f3CaqRJ8.cs |
High entropy of concatenated method names: 'c78HLgHUJD', 'OBcHak649G', 'HxgHShtAgg', 'D7AH03dKoM', 'RU2HDuDAkb', 'r8fSy1OZPp', 'ld3SCkaKsE', 'dqZSE4uAIY', 'sVjSJL2H0w', 'fGRSe1Mo6S' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, WHxJ2tyopBTMyOacdk.cs |
High entropy of concatenated method names: 'kc60OmF2oo', 'qQv0WULlM8', 'NDL02FH5fP', 'HSm0BrfdRb', 'Hpe0xmPnWd', 'Ywq0vpPw6W', 'juF03HXE3f', 'fBJ0genqfJ', 'y6L0U7JlFI', 'dDt04ixvVE' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, eoECqEoP1MV499hB3G.cs |
High entropy of concatenated method names: 'ToString', 'wheGQdrMV0', 'X8oGt9PNmQ', 'cB2GcFGSZO', 'MGBGqIH73k', 'qraGmQh86Y', 'HotGwQikvy', 'T9JGd1uxqQ', 'NvXG5d7waa', 'ip6G1ABwCa' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, j4jqMnwViZQb4cRVS7.cs |
High entropy of concatenated method names: 'C9HVBUcx40', 'CkBVvXsIr4', 'EiFVg3cDwC', 'l7qVU2qi0a', 'tomVsRKk2M', 'VFSVGX4w9O', 'PYpVpv8PZb', 'FjLVXSkC6V', 'EyMVKJyQx1', 'WeGVh5xc7G' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, R0k6N6vsjjBavB4q3V.cs |
High entropy of concatenated method names: 'd8EfglaEhg', 'DPqfUINGbJ', 'F9qf9Niwtu', 'dT3ftUcLhm', 'XMHfqEONFQ', 'fwRfmkUYMa', 'tIPfdNk927', 'egTf5HkCwQ', 'hd6flQi1gS', 'YOVfQJ8A9a' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, ijAOQ7mRGBRMsxXAQS.cs |
High entropy of concatenated method names: 'id80MrVhlr', 'fsw0VIEihp', 'qC50HAu48f', 'SbtHFc2cwO', 'TSoHzCf1XE', 'cjl08o6SaB', 'UMb07Xp8jK', 'B3K0raOfa1', 'UVw0T6ZRnD', 'o6D0jMNDxJ' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, m27lXb6r4MZHCO3jU8.cs |
High entropy of concatenated method names: 'Sih2OOCtM', 'n52BO9bSD', 'b8RvG7YEC', 'JXZ30KgVr', 'rssU2I0M5', 'rWO4W2Hc1', 'zDuv7tNsEPTgry2KMo', 'C5w0yhE86TSUGIafMT', 'UZGX8cNuO', 'g2XhkjOhy' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, NmD84IhXqX5T6TEkV6.cs |
High entropy of concatenated method names: 'wCHpJPJyR0', 'sxRpFvTw8H', 'eJMX8bKCu2', 'fUQX79yjrG', 'VZUpQaEvUO', 'x3opPsGdNj', 'xy0pALit6q', 'WV5pRXljyr', 'OxCpZLEIc9', 'cOPpnkgyns' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, F2PTqtdykfFUcIb56j.cs |
High entropy of concatenated method names: 'AYgX9KKbxn', 'IqJXtfDiRt', 'UREXcWxQJf', 'VvfXqHxDDH', 'EYjXREkAOI', 'IjNXmuPgeM', 'Next', 'Next', 'Next', 'NextBytes' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, lCRMA5DlhXbJjo7mgP.cs |
High entropy of concatenated method names: 'XOUK7fOCGk', 'eBtKTbHBlE', 'GNrKjjqQYp', 'mniKMCNMTC', 'HkgKaTcPaL', 's5bKSBPZ9g', 'G7kKHQUQjE', 't64XE23Zn0', 'mkBXJjYgka', 'DVXXeBXhbW' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, pr8Do41Q1tqFwxoK05.cs |
High entropy of concatenated method names: 'eWBTLXt3er', 'iOtTMlUF5l', 'OQ4TaT1ZsC', 'VibTVbpR7H', 'ADVTS4dCv0', 'KadTHMkTAy', 'vNhT0qwQbT', 'VZtTD7HKkP', 'dxpTIOGC08', 'qQHTu998oi' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, rhi5WUbqRqYWJ4I5aL.cs |
High entropy of concatenated method names: 'gXhpu9v1k5', 'OIqpkIdKxY', 'ToString', 'De3pMtqr5e', 'eIlpa4KGgS', 'jRTpVokqo0', 'LYEpSmeS0j', 'ALqpH6LbN9', 'vosp0ysL2B', 'wmRpDn8t0K' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, CmapgpqkNF7N5qJ90ud.cs |
High entropy of concatenated method names: 'alqKOrJ0pj', 'og8KWuXd29', 'iIAK2rCVFe', 'GWTKBUdRp1', 'UwMKx4rRBo', 'RDHKvT0qhU', 'fjHK3v12CM', 'cmdKgBShHa', 'YhIKUBFLmT', 'JmNK404BNS' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, HZasU9nsywqiKFgaDv.cs |
High entropy of concatenated method names: 'onQaRYYxBE', 'IM2aZtghIN', 'RpFanjrrNu', 'sIka6VaZwU', 'BavayUICgv', 'PdAaCMI85I', 'KmEaES8IZt', 'nKraJ28955', 'opkaew46xI', 'K1xaFe1Yc2' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, t3dR5NEyPQ0BnbAjPf.cs |
High entropy of concatenated method names: 'KNHXMolEP8', 'MFVXaqPpuS', 'APNXVJBc3n', 'bE9XSoGTZE', 'uoYXHO6fxn', 'AYZX0iFBhY', 'OGvXD9JRVh', 'dHcXIGfsdW', 'TIpXufgcOF', 'wufXkDqp0f' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, zUd261zcGb9YwcjLSm.cs |
High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UUtKfeexau', 'QuMKsB0qwN', 'vbwKGbQ8Rm', 'GC9KpQCDUY', 'qhYKX3mUHu', 't4TKKjEyun', 'v3iKhbT2Un' |
Source: 0.2.proof of payment.exe.3a79b88.1.raw.unpack, ir4OiiaLqZUjSaiS1D.cs |
High entropy of concatenated method names: 'BPZ70EqBf8', 'Iso7D7DIGj', 'mON7u8pSmB', 'otW7kHJ1EU', 'Nph7snNx7b', 'N7o7Gd9CgL', 'YWb0Zj1DxBQUSZDFr5', 'd0DGejsIX4gCSvvaDM', 'gTr77yfym1', 'fiq7TWyUCH' |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
7_2_100010F1 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 7_2_10006580 FindFirstFileExA, |
7_2_10006580 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_00409253 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose, |
12_2_0041C291 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose, |
12_2_0040C34D |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose, |
12_2_00409665 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0044E879 FindFirstFileExA, |
12_2_0044E879 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose, |
12_2_0040880C |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040783C FindFirstFileW,FindNextFileW, |
12_2_0040783C |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW, |
12_2_00419AF5 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, |
12_2_0040BB30 |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Code function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, |
12_2_0040BD37 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 15_2_0040AE51 FindFirstFileW,FindNextFileW, |
15_2_0040AE51 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 17_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen, |
17_2_00407EF8 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Code function: 20_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen, |
20_2_00407898 |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Users\user\Desktop\proof of payment.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\ VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Queries volume information: C:\Users\user\AppData\Roaming\NvbYSEq.exe VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\AppData\Roaming\NvbYSEq.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\proof of payment.exe |
Queries volume information: C:\ VolumeInformation |
|