Windows Analysis Report
107.exe

Overview

General Information

Sample name: 107.exe
Analysis ID: 1537509
MD5: 468bbc70a56325cc39d82e796879faa2
SHA1: 5488f804a50f35be53fbf646ecb75d0211f180f3
SHA256: 4732e7bbf0eb82ab024b4758bab398bb45320f45dbec2073bda054cce01b6d61
Tags: exeuser-V3n0mStrike
Infos:

Detection

RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected RedLine Stealer
AI detected suspicious sample
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to debug other processes
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 107.exe ReversingLabs: Detection: 31%
Source: 107.exe Virustotal: Detection: 28% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00459B90 RegOpenKeyExW,GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GlobalMemoryStatusEx,GetDiskFreeSpaceExW,GetSystemTimes,QueryPerformanceCounter,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 0_2_00459B90
Uses 32bit PE files
Source: 107.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.LICENSE.txt Jump to behavior
Source: Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb source: 107.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06EFDB95h 1_2_06EFD5B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 07B9556Ch 1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 07B9556Ch 1_2_07B94580

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49704 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:49704
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49705 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49711 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49706 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49708 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49713 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49716 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49761 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49767 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49749 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49801 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49782 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49773 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49795 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49807 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49789 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49819 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49813 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49825 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49831 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49754 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49848 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49860 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49866 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49854 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49872 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49878 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49894 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49884 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49900 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49906 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49913 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49840 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49919 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49925 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49932 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49938 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49951 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49967 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49957 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49973 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49991 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49997 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50004 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49944 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50014 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50019 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50027 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50025 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50028 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50029 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50031 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50030 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50032 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50033 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50034 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50035 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50038 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50037 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50039 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50042 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50041 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50036 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50040 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50043 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49979 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50042
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50045 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50046 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50048 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50047 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50049 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50050 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49985 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50052 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50053 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50054 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50044 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50051 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50048
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50055 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50056 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50058 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50051
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50057 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50059 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50058
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50060 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50061 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50062 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50063 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50064 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50065 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50067 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50066 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50069 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50070 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50071 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50072 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50067
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50073 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50074 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50068 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50075 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50076 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50077 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50081 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50078 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50079 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50080 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50082 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50083 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50085 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50084 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50081
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50086 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50087 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50088 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50089 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50090 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50091 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50092 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50085
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50093 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50094 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50096 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50097 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50098 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50099 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50100 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50102 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50103 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50104 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50105 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50106 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50107 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50108 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50109 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50110 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50111 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50112 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50113 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50114 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50115 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50116 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50095 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50117 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50118 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50119 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50120 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50121 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50122 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50123 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50124 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50125 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50126 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50127 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50128 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50130 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50129 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50131 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50132 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50133 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50130
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50134 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50135 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50136 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50138 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50139 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50137 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50140 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50141 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50139
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50142 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50143 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50144 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50145 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50146 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50147 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50148 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50149 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50150 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50151 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50153 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50152 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50155 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50156 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50157 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50153
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50158 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50159 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50154 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50161 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50160 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50162 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50163 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50164 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50165 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50161
Source: Network traffic Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50168 -> 213.109.202.97:15647
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50167 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50169 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50170 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50171 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50172 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50173 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50168
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50175 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50176 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50174 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50177 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50178 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50179 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50180 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50181 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50182 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50183 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50166 -> 213.109.202.97:9000
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 213.109.202.97 ports 9000,1,4,5,6,7,15647
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 49925 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49925
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 50030 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50030
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50183
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49704 -> 213.109.202.97:15647
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjfl?q=02a10a9fb79f454eb9b579eb295605f6 HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UA-LINK-ASUA UA-LINK-ASUA
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49761 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49767 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49801 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49795 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49773 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49782 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49807 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49789 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49819 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49813 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49825 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49831 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49754 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49848 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49860 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49866 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49854 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49872 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49878 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49884 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49894 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49900 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49906 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49913 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49840 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49919 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49925 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49932 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49938 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49951 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49967 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49957 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49973 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49991 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49997 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50004 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49944 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50014 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50019 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50025 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50027 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50028 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50029 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50030 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50031 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50032 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50033 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50034 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50035 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50036 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50040 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50043 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49979 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50045 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50046 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50047 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50049 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50050 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49985 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50052 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50053 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50054 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50044 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50055 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50056 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50059 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50060 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50061 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50062 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50063 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50064 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50066 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50069 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50070 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50071 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50072 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50073 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50074 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50068 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50075 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50077 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50078 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50079 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50080 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50082 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50083 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50084 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50086 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50087 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50088 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50090 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50091 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50092 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50093 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50094 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50096 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50097 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50098 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50099 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50100 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50103 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50104 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50105 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50106 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50107 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50108 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50109 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50110 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50111 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50112 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50113 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50114 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50115 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50116 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50095 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50117 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50118 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50119 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50120 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50121 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50123 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50133 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50141 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50147 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50150 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50152 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50155 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50159 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50160 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50170 -> 213.109.202.97:9000
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50175 -> 213.109.202.97:9000
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjfl?q=02a10a9fb79f454eb9b579eb295605f6 HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002C17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://213.109.202.97:9000
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002C17000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://213.109.202.97:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: licenses.html.1.dr String found in binary or memory: http://www.droidfonts.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: manifest.json.1.dr String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Secure Preferences.1.dr String found in binary or memory: https://chrome.google.com/webstore
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Secure Preferences.1.dr, manifest.json.1.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Secure Preferences.1.dr String found in binary or memory: https://docs.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-autopush.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-preprod.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive-staging.corp.google.com/
Source: Secure Preferences.1.dr String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: licenses.html.1.dr String found in binary or memory: https://github.com/Authenticator-Extension
Source: licenses.html.1.dr String found in binary or memory: https://github.com/FortAwesome/Font-Awesome
Source: licenses.html.1.dr String found in binary or memory: https://github.com/multiwebinc
Source: manifest.json.1.dr String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/token
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/Ld9GfkdJ
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: manifest.json.1.dr String found in binary or memory: https://www.google.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr String found in binary or memory: https://www.googleapis.com/auth/drive.file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004473E0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess, 0_2_004473E0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004568B0 NtOpenKey, 0_2_004568B0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004569E0 NtQueryKey, 0_2_004569E0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00456AC0 NtDeleteKey,NtClose,RegCloseKey,SetLastError, 0_2_00456AC0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0045ED20 GetFileAttributesW,CreateFileW,NtSystemDebugControl,CloseHandle,GetLastError,DeleteFileW,GetCurrentProcess,CheckRemoteDebuggerPresent,GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,GetCurrentProcess,FlushInstructionCache, 0_2_0045ED20
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00403010: OpenProcess,K32GetProcessImageFileNameW,CloseHandle,DebugActiveProcess,DebugSetProcessKillOnExit,WaitForDebugEvent,SetEvent,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,OpenProcess,DebugBreakProcess,CloseHandle,ContinueDebugEvent,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,CloseHandle,OpenThread,SetThreadToken,CloseHandle,OpenProcess,ReadProcessMemory,CloseHandle,OpenThread,GetThreadContext,DebugSetProcessKillOnExit,GetThreadContext,GetSystemTimeAsFileTime,GetFileAttributesExW,CloseHandle,CreateFileW,GetLastError,DebugActiveProcessStop,DeviceIoControl,GetLastError,CloseHandle,DebugActiveProcessStop,GetLastError,GetLastError, 0_2_00403010
Contains functionality to delete services
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200
Detected potential crypto function
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00403010 0_2_00403010
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004160F0 0_2_004160F0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005BB110 0_2_005BB110
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042B1C0 0_2_0042B1C0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 0_2_0042C200
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004182D0 0_2_004182D0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041C2F0 0_2_0041C2F0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0040A2A0 0_2_0040A2A0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00417340 0_2_00417340
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00591340 0_2_00591340
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0045C450 0_2_0045C450
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005B44CA 0_2_005B44CA
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00422500 0_2_00422500
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00415590 0_2_00415590
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0043E6A0 0_2_0043E6A0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041E6B0 0_2_0041E6B0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041F740 0_2_0041F740
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00413750 0_2_00413750
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041B830 0_2_0041B830
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00417970 0_2_00417970
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00419B90 0_2_00419B90
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041DBB0 0_2_0041DBB0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041CC40 0_2_0041CC40
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041BCB0 0_2_0041BCB0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0041AD20 0_2_0041AD20
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00599E40 0_2_00599E40
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00405EA0 0_2_00405EA0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A1000 0_2_045A1000
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A9562 0_2_045A9562
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A368F 0_2_045A368F
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045AAD41 0_2_045AAD41
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A8FF0 0_2_045A8FF0
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A6826 0_2_045A6826
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A9AD4 0_2_045A9AD4
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045ABBFC 0_2_045ABBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7C880 1_2_00E7C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E71070 1_2_00E71070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7B01F 1_2_00E7B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7D110 1_2_00E7D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E715E0 1_2_00E715E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7BD78 1_2_00E7BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7A8FB 1_2_00E7A8FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7C862 1_2_00E7C862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7A908 1_2_00E7A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7D0F3 1_2_00E7D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7B09E 1_2_00E7B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E71067 1_2_00E71067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E715D7 1_2_00E715D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7BD45 1_2_00E7BD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D76C48 1_2_06D76C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D70DEF 1_2_06D70DEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D70040 1_2_06D70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D71800 1_2_06D71800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7E830 1_2_06D7E830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D72761 1_2_06D72761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7BCFA 1_2_06D7BCFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D72430 1_2_06D72430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7BD6A 1_2_06D7BD6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7BD00 1_2_06D7BD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D70BC8 1_2_06D70BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7C818 1_2_06D7C818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7C809 1_2_06D7C809
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7E008 1_2_06D7E008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF67B8 1_2_06EF67B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF3759 1_2_06EF3759
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EFDF52 1_2_06EFDF52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF4CE0 1_2_06EF4CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF2CA1 1_2_06EF2CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF74B0 1_2_06EF74B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF5498 1_2_06EF5498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EFB0A0 1_2_06EFB0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF0040 1_2_06EF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF0828 1_2_06EF0828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EFC660 1_2_06EFC660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EFC670 1_2_06EFC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF4F90 1_2_06EF4F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF4CCF 1_2_06EF4CCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF2478 1_2_06EF2478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF0006 1_2_06EF0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF0818 1_2_06EF0818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06EF818A 1_2_06EF818A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07687674 1_2_07687674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07687AF8 1_2_07687AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_0768E9A0 1_2_0768E9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07685F6C 1_2_07685F6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07688F70 1_2_07688F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_0768DD70 1_2_0768DD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_0768E940 1_2_0768E940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B90E90 1_2_07B90E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B982C8 1_2_07B982C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B98A08 1_2_07B98A08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B99278 1_2_07B99278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9C5AA 1_2_07B9C5AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B94580 1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B96D38 1_2_07B96D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9F0D5 1_2_07B9F0D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9BB80 1_2_07B9BB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B95BF8 1_2_07B95BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B95BE9 1_2_07B95BE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9CF53 1_2_07B9CF53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B95598 1_2_07B95598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B95587 1_2_07B95587
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B905C8 1_2_07B905C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B96D0B 1_2_07B96D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B97960 1_2_07B97960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B94580 1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9B020 1_2_07B9B020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9B010 1_2_07B9B010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B90006 1_2_07B90006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B90040 1_2_07B90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9D300 1_2_07B9D300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07B9D2F0 1_2_07B9D2F0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\107.exe Code function: String function: 00423020 appears 98 times
Source: C:\Users\user\Desktop\107.exe Code function: String function: 00427770 appears 40 times
Sample file is different than original file name gathered from version info
Source: 107.exe Binary or memory string: OriginalFilename vs 107.exe
Source: 107.exe, 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameavDump.exeB vs 107.exe
Source: 107.exe, 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe, 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe, 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe Binary or memory string: OriginalFilenameavDump.exeB vs 107.exe
Uses 32bit PE files
Source: 107.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45b30d0.4.raw.unpack, -Module-.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.107.exe.4680000.5.raw.unpack, -Module-.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, -Module-.cs Cryptographic APIs: 'CreateDecryptor'
Source: 107.exe Binary string: DUnable to retrieve the path of the module!Unable to get the path of the module!Unable to store the path of the module!SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersUnable to retrieve a path of the known folder ({})!Common AppData%APPDATA%%LOCALAPPDATA%ProgramFilesProgramW6432ProgramFiles(x86)ProgramFiles(Arm)ProgramFilesDirSOFTWARE\Microsoft\Windows\CurrentVersionProgramFilesDir (x86)ProgramFilesDir (arm)CommonProgramFilesCommonProgramFiles(x86)CommonFilesDirCommonFilesDir (x86)\\?\Unable to enumerate volumes!Unable to convert NT path '{}' to a volume GUID path!Unable to retrieve volume paths for volume '{}'!\Device\LanmanRedirector\\Device\Mup\\SystemRoot\\\.\GLOBALROOTHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA<Unknown or opened key>32-bit 64-bit )path: (on (on value: String environment expansion failedString environment expansion failed due to unexpected buffer sizeCannot query registry value typeCannot enumerate subkeysCannot query key info to enumerate key value namesCannot enumerate key value namesCannot open registry keyCannot create registry keyFailed to register change async notificationUnable to open registry key handle using NtOpenKeyCannot query kernel mode registry key pathCannot delete registry keyCannot delete registry key treeCannot delete registry valueCannot write key valueCannot query multiple valuesCannot query registry valueCannot query registry value sizeCannot query registry value dataCannot query registry data due to '{}' value changed too often), but queried different type than expectedQuerying registry value (L
Source: tmpDC8Ctmp.zip.1.dr Binary or memory string: ~.vBp5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/145@0/1
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00459B90 RegOpenKeyExW,GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GlobalMemoryStatusEx,GetDiskFreeSpaceExW,GetSystemTimes,QueryPerformanceCounter,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 0_2_00459B90
Source: C:\Users\user\Desktop\107.exe Code function: QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Yandex Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\9a6266ed752044c78662da8da86e77c4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\tmp67CB.tmp Jump to behavior
Source: 107.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\107.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 107.exe ReversingLabs: Detection: 31%
Source: 107.exe Virustotal: Detection: 28%
Source: 107.exe String found in binary or memory: company-install-path
Source: 107.exe String found in binary or memory: SecureLineSecure VPNHMA! Pro VPNVPNTuneupTuneUpCleanupUtilitiesBatterySaverDriverUpdaterBreachGuardAntiTrackKamoSoftware\\IcarusSYSTEM\Software\PersistentStorageOverrideDataFolderLogssettingsproduct-reg-keyreg-keyicarus.iniprogram-data-dirdata-dirproduct-dircompany-install-pathcouldn't open filecouldn't obtain exclusive file lockinvalid string_view position
Source: unknown Process created: C:\Users\user\Desktop\107.exe "C:\Users\user\Desktop\107.exe"
Source: C:\Users\user\Desktop\107.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe"
Source: C:\Users\user\Desktop\107.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe" Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Users\user\Desktop\107.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: 107.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 107.exe Static file information: File size 4083200 > 1048576
Source: 107.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1f0200
Source: 107.exe Static PE information: More than 200 imports for KERNEL32.dll
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 107.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb source: 107.exe
Source: 107.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 107.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 107.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 107.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 107.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004613E0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetEvent, 0_2_004613E0
PE file contains an invalid checksum
Source: 107.exe Static PE information: real checksum: 0x32286d should be: 0x3ee7c3
PE file contains sections with non-standard names
Source: 107.exe Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00599247 push ecx; ret 0_2_0059925A
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042A791 push E8FFFFFEh; iretd 0_2_0042A796
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045B2DC0 push eax; ret 0_2_045B2E21
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045B2E70 push eax; ret 0_2_045B2E21
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A2E15 push ecx; ret 0_2_045A2E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_00E7EC5D push eax; iretd 1_2_00E7EC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_06D7814A push esp; ret 1_2_06D78151
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 1_2_07687968 push es; iretd 1_2_07687974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.LICENSE.txt Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.LICENSE.txt Jump to behavior
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 49925 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49925
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 49957 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49957
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 49979 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49979
Source: unknown Network traffic detected: HTTP traffic on port 49985 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49985
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 50004 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50004
Source: unknown Network traffic detected: HTTP traffic on port 50014 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50014
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50025 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50025
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 50030 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50030
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 50183
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A368F EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_045A368F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 2B70000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 4B70000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00459B90 rdtsc 0_2_00459B90
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 1989 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 7560 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\107.exe API coverage: 3.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -27670116110564310s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59890s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -33966s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59781s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -34686s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59672s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59562s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59453s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -42936s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59343s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -52114s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59230s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984 Thread sleep time: -59062s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -39120s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -50964s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -44683s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -55819s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -39392s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -53059s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -49454s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -50861s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -49491s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -36765s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -33263s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -58856s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -34904s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -54936s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -33115s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -45458s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -51486s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -42085s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -47669s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -35326s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -35956s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -33699s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -42091s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -34551s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -39042s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676 Thread sleep time: -42012s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 60000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59890 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 33966 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59781 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 34686 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59672 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59562 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59453 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 42936 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59343 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 52114 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59230 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 59062 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 39120 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 50964 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 44683 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 55819 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 39392 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 53059 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 49454 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 50861 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 60000 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 49491 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 36765 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 33263 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 58856 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 34904 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 54936 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 33115 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 45458 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 51486 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 42085 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 47669 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 35326 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 35956 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 33699 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 42091 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 34551 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 39042 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 42012 Jump to behavior
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: RegAsm.exe, 00000001.00000002.4488678862.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0045ED20 GetFileAttributesW,CreateFileW,NtSystemDebugControl,CloseHandle,GetLastError,DeleteFileW,GetCurrentProcess,CheckRemoteDebuggerPresent,GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,GetCurrentProcess,FlushInstructionCache, 0_2_0045ED20
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00459B90 rdtsc 0_2_00459B90
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005A3B93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005A3B93
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A7DE6 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_045A7DE6
Contains functionality to debug other processes
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00403010 OpenProcess,K32GetProcessImageFileNameW,CloseHandle,DebugActiveProcess,DebugSetProcessKillOnExit,WaitForDebugEvent,SetEvent,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,OpenProcess,DebugBreakProcess,CloseHandle,ContinueDebugEvent,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,CloseHandle,OpenThread,SetThreadToken,CloseHandle,OpenProcess,ReadProcessMemory,CloseHandle,OpenThread,GetThreadContext,DebugSetProcessKillOnExit,GetThreadContext,GetSystemTimeAsFileTime,GetFileAttributesExW,CloseHandle,CreateFileW,GetLastError,DebugActiveProcessStop,DeviceIoControl,GetLastError,CloseHandle,DebugActiveProcessStop,GetLastError,GetLastError, 0_2_00403010
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_004613E0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetEvent, 0_2_004613E0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005B541A mov eax, dword ptr fs:[00000030h] 0_2_005B541A
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005B1572 mov ecx, dword ptr fs:[00000030h] 0_2_005B1572
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A3860 GetProcessHeap, 0_2_045A3860
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00598B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00598B9C
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_005A3B93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005A3B93
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A4390 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_045A4390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\107.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A1000 _memset,GetCommandLineW,CreateProcessW,GetLastError,_wprintf,VirtualAlloc,GetLastError,_wprintf,_memmove,_memset,Wow64GetThreadContext,GetLastError,_wprintf,ReadProcessMemory,GetLastError,_wprintf,GetModuleHandleA,GetProcAddress,GetLastError,_wprintf,VirtualAllocEx,VirtualAllocEx,GetLastError,VirtualAllocEx,GetLastError,_wprintf,WriteProcessMemory,WriteProcessMemory,_wprintf,WriteProcessMemory,Wow64SetThreadContext,GetLastError,_wprintf,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,ResumeThread,GetLastError,_wprintf,GetLastError,_wprintf,GetLastError,_wprintf, 0_2_045A1000
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A92008 Jump to behavior
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4C2000 Jump to behavior
Source: C:\Users\user\Desktop\107.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4C4000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\107.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_045A63F2 cpuid 0_2_045A63F2
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW, 0_2_005B50C4
Source: C:\Users\user\Desktop\107.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_005BB65F
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW, 0_2_005BB860
Source: C:\Users\user\Desktop\107.exe Code function: EnumSystemLocalesW, 0_2_005BB952
Source: C:\Users\user\Desktop\107.exe Code function: EnumSystemLocalesW, 0_2_005BB907
Source: C:\Users\user\Desktop\107.exe Code function: EnumSystemLocalesW, 0_2_005BB9ED
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_005BBA80
Source: C:\Users\user\Desktop\107.exe Code function: EnumSystemLocalesW, 0_2_005B4B7D
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW, 0_2_005BBCE0
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_005BBE09
Source: C:\Users\user\Desktop\107.exe Code function: GetLocaleInfoW, 0_2_005BBF0F
Source: C:\Users\user\Desktop\107.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_005BBFDE
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_00582290 QueryUnbiasedInterruptTime,GetSystemTimes, 0_2_00582290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 00000001.00000002.4488678862.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4494113492.0000000006B4F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4488678862.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\107.exe Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError, 0_2_0042C200
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
213.109.202.97
 unknown unknown
34359 UA-LINK-ASUA true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://213.109.202.97:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F true
    		unknown