Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C14696 GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_00C14696 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_00C1C9C7 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1C93C FindFirstFileW,FindClose, | 0_2_00C1C93C |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00C1F200 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00C1F35D |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 0_2_00C1F65E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C13A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_00C13A2B |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C13D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_00C13D4E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 0_2_00C1BF27 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A24696 GetFileAttributesW,FindFirstFileW,FindClose, | 8_2_00A24696 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 8_2_00A2C9C7 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2C93C FindFirstFileW,FindClose, | 8_2_00A2C93C |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 8_2_00A2F200 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 8_2_00A2F35D |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 8_2_00A2F65E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A23A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 8_2_00A23A2B |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A23D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 8_2_00A23D4E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 8_2_00A2BF27 |
Source: RegSvcs.exe, 0000000B.00000002.3452111397.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.00000000032E9000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://api.telegram.org |
Source: RegSvcs.exe, 0000000B.00000002.3452111397.0000000002D07000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.00000000032D7000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: RegSvcs.exe, 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp | String found in binary or memory: https://account.dyn.com/ |
Source: RegSvcs.exe, 0000000B.00000002.3452111397.0000000002D07000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3452111397.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.00000000032D7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.0000000003490000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org |
Source: RegSvcs.exe, 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3452111397.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.000000000328E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot7166327996:AAGPihVNd1ShcG_CmE24Dqt8T2_CJLtBA7k/ |
Source: RegSvcs.exe, 0000000B.00000002.3452111397.0000000002D03000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3452111397.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.00000000032D3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3842075995.0000000003490000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://api.telegram.org/bot7166327996:AAGPihVNd1ShcG_CmE24Dqt8T2_CJLtBA7k/sendDocument |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C3CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, | 0_2_00C3CDAC |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A4CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, | 8_2_00A4CDAC |
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 14.2.name.exe.3c50000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 8.2.name.exe.33a0000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 10.2.name.exe.3710000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0000000A.00000002.3336864673.0000000003710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 00000008.00000002.3304083272.00000000033A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0000000B.00000002.3449507339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 0000000E.00000002.3449893133.0000000003C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects RedLine infostealer Author: ditekSHen |
Source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: This is a third-party compiled AutoIt script. | 0_2_00BB3B4C |
Source: Case_Your company bad driver Vehicle No.exe | String found in binary or memory: This is a third-party compiled AutoIt script. | |
Source: Case_Your company bad driver Vehicle No.exe, 00000000.00000002.3289527528.0000000000C65000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_847bcc26-5 |
Source: Case_Your company bad driver Vehicle No.exe, 00000000.00000002.3289527528.0000000000C65000.00000002.00000001.01000000.00000003.sdmp | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_4d9c76af-9 |
Source: Case_Your company bad driver Vehicle No.exe, 00000000.00000003.3276476256.0000000003E55000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_8fb44ef2-6 |
Source: Case_Your company bad driver Vehicle No.exe, 00000000.00000003.3276476256.0000000003E55000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_c659b848-3 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: This is a third-party compiled AutoIt script. | 8_2_009C3B4C |
Source: name.exe | String found in binary or memory: This is a third-party compiled AutoIt script. | |
Source: name.exe, 00000008.00000000.3288300355.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_a59d631b-0 |
Source: name.exe, 00000008.00000000.3288300355.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_122a512e-b |
Source: name.exe, 0000000A.00000000.3302257996.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_cba64940-b |
Source: name.exe, 0000000A.00000000.3302257996.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_af207b85-7 |
Source: name.exe, 0000000E.00000002.3448805227.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_01034b26-c |
Source: name.exe, 0000000E.00000002.3448805227.0000000000A75000.00000002.00000001.01000000.00000005.sdmp | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_70c22f54-3 |
Source: Case_Your company bad driver Vehicle No.exe | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_9f1ae70c-5 |
Source: Case_Your company bad driver Vehicle No.exe | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_ce67c117-1 |
Source: name.exe.0.dr | String found in binary or memory: This is a third-party compiled AutoIt script. | memstr_426733da-3 |
Source: name.exe.0.dr | String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer | memstr_94d126c4-d |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BBE800 | 0_2_00BBE800 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BDDBB5 | 0_2_00BDDBB5 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C3804A | 0_2_00C3804A |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BBE060 | 0_2_00BBE060 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC4140 | 0_2_00BC4140 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD2405 | 0_2_00BD2405 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE6522 | 0_2_00BE6522 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C30665 | 0_2_00C30665 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE267E | 0_2_00BE267E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD283A | 0_2_00BD283A |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC6843 | 0_2_00BC6843 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE89DF | 0_2_00BE89DF |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C30AE2 | 0_2_00C30AE2 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE6A94 | 0_2_00BE6A94 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC8A0E | 0_2_00BC8A0E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C0EB07 | 0_2_00C0EB07 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C18B13 | 0_2_00C18B13 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BDCD61 | 0_2_00BDCD61 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE7006 | 0_2_00BE7006 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC3190 | 0_2_00BC3190 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC710E | 0_2_00BC710E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BB1287 | 0_2_00BB1287 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD33C7 | 0_2_00BD33C7 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BDF419 | 0_2_00BDF419 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC5680 | 0_2_00BC5680 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD16C4 | 0_2_00BD16C4 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD78D3 | 0_2_00BD78D3 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BC58C0 | 0_2_00BC58C0 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD1BB8 | 0_2_00BD1BB8 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BE9D05 | 0_2_00BE9D05 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BBFE40 | 0_2_00BBFE40 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BDBFE6 | 0_2_00BDBFE6 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD1FD0 | 0_2_00BD1FD0 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_015136F0 | 0_2_015136F0 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009CE800 | 8_2_009CE800 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009EDBB5 | 8_2_009EDBB5 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A4804A | 8_2_00A4804A |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009CE060 | 8_2_009CE060 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D4140 | 8_2_009D4140 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E2405 | 8_2_009E2405 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F6522 | 8_2_009F6522 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A40665 | 8_2_00A40665 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F267E | 8_2_009F267E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E283A | 8_2_009E283A |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D6843 | 8_2_009D6843 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F89DF | 8_2_009F89DF |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F6A94 | 8_2_009F6A94 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A40AE2 | 8_2_00A40AE2 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D8A0E | 8_2_009D8A0E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A1EB07 | 8_2_00A1EB07 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A28B13 | 8_2_00A28B13 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009ECD61 | 8_2_009ECD61 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F7006 | 8_2_009F7006 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D3190 | 8_2_009D3190 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D710E | 8_2_009D710E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009C1287 | 8_2_009C1287 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E33C7 | 8_2_009E33C7 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009EF419 | 8_2_009EF419 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D5680 | 8_2_009D5680 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E16C4 | 8_2_009E16C4 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E78D3 | 8_2_009E78D3 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009D58C0 | 8_2_009D58C0 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E1BB8 | 8_2_009E1BB8 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009F9D05 | 8_2_009F9D05 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009CFE40 | 8_2_009CFE40 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E1FD0 | 8_2_009E1FD0 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009EBFE6 | 8_2_009EBFE6 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00F136F0 | 8_2_00F136F0 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 10_2_00F036F0 | 10_2_00F036F0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00408C60 | 11_2_00408C60 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0040DC11 | 11_2_0040DC11 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00407C3F | 11_2_00407C3F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00418CCC | 11_2_00418CCC |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00406CA0 | 11_2_00406CA0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_004028B0 | 11_2_004028B0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0041A4BE | 11_2_0041A4BE |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00418244 | 11_2_00418244 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00401650 | 11_2_00401650 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00402F20 | 11_2_00402F20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_004193C4 | 11_2_004193C4 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00418788 | 11_2_00418788 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00402F89 | 11_2_00402F89 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00402B90 | 11_2_00402B90 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_004073A0 | 11_2_004073A0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02ABD090 | 11_2_02ABD090 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02ABD960 | 11_2_02ABD960 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02ABCD48 | 11_2_02ABCD48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB1030 | 11_2_02AB1030 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A2C4C0 | 11_2_05A2C4C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A2E780 | 11_2_05A2E780 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A26FF9 | 11_2_05A26FF9 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A24C20 | 11_2_05A24C20 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A25428 | 11_2_05A25428 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A28F48 | 11_2_05A28F48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A2EED0 | 11_2_05A2EED0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A20007 | 11_2_05A20007 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A20040 | 11_2_05A20040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063C4DF8 | 11_2_063C4DF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063C9BF8 | 11_2_063C9BF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063C0CF0 | 11_2_063C0CF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063C8268 | 11_2_063C8268 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063CE2E8 | 11_2_063CE2E8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D3CD48 | 15_2_02D3CD48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D3D960 | 15_2_02D3D960 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D3D090 | 15_2_02D3D090 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D31030 | 15_2_02D31030 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03258B80 | 15_2_03258B80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_0325E780 | 15_2_0325E780 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03256485 | 15_2_03256485 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_0325C4C0 | 15_2_0325C4C0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03250006 | 15_2_03250006 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03250040 | 15_2_03250040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03264DF0 | 15_2_03264DF0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03269CD0 | 15_2_03269CD0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_0326E2D8 | 15_2_0326E2D8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03267FB0 | 15_2_03267FB0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03260CF0 | 15_2_03260CF0 |
Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 14.2.name.exe.3c50000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 8.2.name.exe.33a0000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 10.2.name.exe.3710000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0000000A.00000002.3336864673.0000000003710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 00000008.00000002.3304083272.00000000033A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0000000B.00000002.3449507339.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 0000000E.00000002.3449893133.0000000003C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073 |
Source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY | Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Section loaded: apphelp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sxs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: vbscript.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: amsi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: profapi.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msasn1.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptsp.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: rsaenh.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: cryptbase.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: msisip.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wshext.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrobj.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mlang.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: scrrun.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: propsys.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: edputil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: urlmon.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: iertutil.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: srvcli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: netutils.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: windows.staterepositoryps.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sspicli.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: wintypes.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: appresolver.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: bcp47langs.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: slc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: sppc.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecorecommonproxystub.dll | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Section loaded: onecoreuapcommonproxystub.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wsock32.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: version.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: winmm.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: mpr.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wininet.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: iphlpapi.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: userenv.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: uxtheme.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: kernel.appcore.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: windows.storage.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: wldp.dll | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Section loaded: ntmarta.dll | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BD8B85 push ecx; ret | 0_2_00BD8B98 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009E8B85 push ecx; ret | 8_2_009E8B98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0041C40C push cs; iretd | 11_2_0041C4E2 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_00423149 push eax; ret | 11_2_00423179 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0041C50E push cs; iretd | 11_2_0041C4E2 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_004231C8 push eax; ret | 11_2_00423179 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0040E21D push ecx; ret | 11_2_0040E230 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_0041C6BE push ebx; ret | 11_2_0041C6BF |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB1E80 push edx; retf | 11_2_02AB1E82 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB462A push edx; retf | 11_2_02AB462C |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB6604 push edx; retf | 11_2_02AB6614 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB5F8A push edx; retf | 11_2_02AB5F8B |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB57F1 push edx; retf | 11_2_02AB57FB |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB2722 push edx; retf | 11_2_02AB2723 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB4316 pushfd ; iretd | 11_2_02AB4319 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB4758 push edx; retf | 11_2_02AB4763 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB34BB push edx; retf | 11_2_02AB34BD |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB44B8 push edx; retf | 11_2_02AB44BA |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB283B push edx; retf | 11_2_02AB283C |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB4800 push edx; retf | 11_2_02AB4802 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_02AB393E push edx; retf | 11_2_02AB3940 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A2E470 push eax; iretd | 11_2_05A2E471 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A25F99 push 8BFFFFF8h; ret | 11_2_05A25F9F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_05A25A62 push 8BFFFFF7h; ret | 11_2_05A25A68 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063C8718 push esp; retf | 11_2_063C8721 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 11_2_063CDF60 push ecx; retf | 11_2_063CDF62 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D34758 push edx; retf | 15_2_02D34763 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_02D34316 pushfd ; iretd | 15_2_02D34319 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03256399 push 8BFFFFF8h; ret | 15_2_0325639F |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_03255E62 push 8BFFFFF7h; ret | 15_2_03255E68 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Code function: 15_2_0325E470 push eax; iretd | 15_2_0325E471 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00BB4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, | 0_2_00BB4A35 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C355FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, | 0_2_00C355FD |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_009C4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, | 8_2_009C4A35 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A455FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, | 8_2_00A455FD |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\System32\wscript.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Users\user\AppData\Local\directory\name.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599875 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599547 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599313 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599078 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598969 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598844 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597400 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597250 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596995 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596865 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596722 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596600 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596447 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596341 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596221 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596089 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595984 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595874 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595516 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595406 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595297 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594828 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594718 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599778 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598308 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598033 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597907 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597782 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597634 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597428 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597205 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597079 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596782 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596547 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595354 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595250 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595074 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594943 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594805 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594688 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594563 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594328 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594094 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591110 | Jump to behavior |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C14696 GetFileAttributesW,FindFirstFileW,FindClose, | 0_2_00C14696 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 0_2_00C1C9C7 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1C93C FindFirstFileW,FindClose, | 0_2_00C1C93C |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00C1F200 |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 0_2_00C1F35D |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 0_2_00C1F65E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C13A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_00C13A2B |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C13D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 0_2_00C13D4E |
Source: C:\Users\user\Desktop\Case_Your company bad driver Vehicle No.exe | Code function: 0_2_00C1BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 0_2_00C1BF27 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A24696 GetFileAttributesW,FindFirstFileW,FindClose, | 8_2_00A24696 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, | 8_2_00A2C9C7 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2C93C FindFirstFileW,FindClose, | 8_2_00A2C93C |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 8_2_00A2F200 |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, | 8_2_00A2F35D |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 8_2_00A2F65E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A23A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 8_2_00A23A2B |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A23D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, | 8_2_00A23D4E |
Source: C:\Users\user\AppData\Local\directory\name.exe | Code function: 8_2_00A2BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, | 8_2_00A2BF27 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599875 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599547 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599313 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599078 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598969 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598844 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597400 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597250 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596995 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596865 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596722 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596600 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596447 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596341 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596221 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596089 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595984 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595874 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595766 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595641 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595516 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595406 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595297 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595188 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595063 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594938 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594828 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594718 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 922337203685477 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 600000 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599891 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 599778 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598308 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598171 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 598033 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597907 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597782 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597634 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597428 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597205 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 597079 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596782 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596656 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 596547 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595354 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595250 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 595074 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594943 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594805 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594688 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594563 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594438 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594328 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594219 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 594094 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 593110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 592110 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591985 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591860 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591735 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591610 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591485 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591360 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591235 | Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | Thread delayed: delay time: 591110 | Jump to behavior |
Source: Yara match | File source: sslproxydump.pcap, type: PCAP |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032B8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 1440, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 4864, type: MEMORYSTR |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.000000000330C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 1440, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 4864, type: MEMORYSTR |
Source: Yara match | File source: sslproxydump.pcap, type: PCAP |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032B8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.00000000032CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 1440, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 4864, type: MEMORYSTR |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0ee8.5.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f1046.2.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.5490000.6.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.51d0000.4.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.29f015e.1.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 11.2.RegSvcs.exe.3d05d90.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match | File source: 0000000B.00000002.3478077990.00000000051D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.000000000330C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3451674428.00000000029B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3477412077.0000000003CCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3452111397.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000F.00000002.3842075995.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: 0000000B.00000002.3478826370.0000000005490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 1440, type: MEMORYSTR |
Source: Yara match | File source: Process Memory Space: RegSvcs.exe PID: 4864, type: MEMORYSTR |