Windows Analysis Report
iwtYgAXvKB.exe

Overview

General Information

Sample name: iwtYgAXvKB.exe
renamed because original name is a hash value
Original sample name: F16881D17FC93A873CF38D7DBE9E7135.exe
Analysis ID: 1502157
MD5: f16881d17fc93a873cf38d7dbe9e7135
SHA1: c5ec7ddc260622c030306d4eff6015d86adc225b
SHA256: 7ff2a8fbbde8a033ccb679a3780da4812e4843d5aca60767c030379a9e331365
Tags: DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Creates processes via WMI
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Drops PE files to the user root directory
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Files With System Process Name In Unsuspected Locations
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: iwtYgAXvKB.exe Avira: detected
Antivirus detection for URL or domain
Source: http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa3 Avira URL Cloud: Label: malware
Source: http://951499cm.nyashtech.top Avira URL Cloud: Label: malware
Source: http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b Avira URL Cloud: Label: malware
Source: http://951499cm.nyashtech.top/sqlcentralUploads.php Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\containerprovider\bridgeComponentreview.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\winlogon.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\smss.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MhsFZJQzCIAWwGKKZKgtHJpnVmmJDKNszUpodVapiywc\conhost.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\containerprovider\WD8Tyzwe3aBcLS.vbe Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Links\sppsvc.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\6qUMg8BuEM.bat Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Avira: detection malicious, Label: HEUR/AGEN.1323984
Found malware configuration
Source: LhMoEdVbIY.exe.6616.24.memstrmin Malware Configuration Extractor: DCRat {"SCRT": "{\"O\":\"@\",\"F\":\"_\",\"L\":\"<\",\"9\":\"%\",\"i\":\")\",\"I\":\"&\",\"0\":\"^\",\"S\":\",\",\"N\":\"*\",\"T\":\">\",\"z\":\"#\",\"y\":\"-\",\"A\":\";\",\"d\":\"~\",\"2\":\"|\",\"1\":\" \",\"h\":\"(\",\"Q\":\".\",\"5\":\"`\",\"J\":\"!\",\"M\":\"$\"}", "PCRT": "{\"Q\":\"%\",\"v\":\"<\",\"0\":\"#\",\"F\":\" \",\"J\":\")\",\"t\":\"!\",\"B\":\"|\",\"R\":\"$\",\"Z\":\",\",\"V\":\"^\",\"W\":\";\",\"k\":\"~\",\"y\":\"_\",\"U\":\">\",\"N\":\".\",\"d\":\"@\",\"h\":\"&\",\"Y\":\"*\",\"P\":\"`\",\"m\":\"-\",\"X\":\"(\"}", "TAG": "", "MUTEX": "DCR_MUTEX-8osTUeTovr8vFF5yShBK", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}
Multi AV Scanner detection for domain / URL
Source: 951499cm.nyashtech.top Virustotal: Detection: 14% Perma Link
Source: http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b Virustotal: Detection: 15% Perma Link
Source: http://951499cm.nyashtech.top Virustotal: Detection: 14% Perma Link
Source: http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa3 Virustotal: Detection: 12% Perma Link
Source: http://951499cm.nyashtech.top/sqlcentralUploads.php Virustotal: Detection: 12% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\Program Files (x86)\MhsFZJQzCIAWwGKKZKgtHJpnVmmJDKNszUpodVapiywc\conhost.exe ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\MhsFZJQzCIAWwGKKZKgtHJpnVmmJDKNszUpodVapiywc\conhost.exe Virustotal: Detection: 78% Perma Link
Source: C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\Program Files\Windows Mail\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Program Files\Windows Mail\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\Recovery\smss.exe ReversingLabs: Detection: 78%
Source: C:\Recovery\smss.exe Virustotal: Detection: 78% Perma Link
Source: C:\Recovery\winlogon.exe ReversingLabs: Detection: 78%
Source: C:\Recovery\winlogon.exe Virustotal: Detection: 78% Perma Link
Source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe Virustotal: Detection: 80% Perma Link
Source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe Virustotal: Detection: 80% Perma Link
Source: C:\Users\user\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Users\user\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\Users\user\Links\sppsvc.exe ReversingLabs: Detection: 78%
Source: C:\Users\user\Links\sppsvc.exe Virustotal: Detection: 78% Perma Link
Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\LhMoEdVbIY.exe ReversingLabs: Detection: 78%
Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\LhMoEdVbIY.exe Virustotal: Detection: 78% Perma Link
Source: C:\containerprovider\bridgeComponentreview.exe ReversingLabs: Detection: 78%
Source: C:\containerprovider\bridgeComponentreview.exe Virustotal: Detection: 78% Perma Link
Multi AV Scanner detection for submitted file
Source: iwtYgAXvKB.exe ReversingLabs: Detection: 76%
Source: iwtYgAXvKB.exe Virustotal: Detection: 61% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Source: C:\containerprovider\bridgeComponentreview.exe Joe Sandbox ML: detected
Source: C:\Recovery\winlogon.exe Joe Sandbox ML: detected
Source: C:\Recovery\smss.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MhsFZJQzCIAWwGKKZKgtHJpnVmmJDKNszUpodVapiywc\conhost.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Source: C:\Users\user\Links\sppsvc.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: iwtYgAXvKB.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: iwtYgAXvKB.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\containerprovider\bridgeComponentreview.exe Directory created: C:\Program Files\Windows Mail\LhMoEdVbIY.exe Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Directory created: C:\Program Files\Windows Mail\8995e9fee2d9e2 Jump to behavior
Source: iwtYgAXvKB.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: iwtYgAXvKB.exe, UYOTATHKKW9YY9G.exe.26.dr, LOU1YTO9ROLERK7.exe.24.dr
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_007AA5F4
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_007BB8E0
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007CAAA8 FindFirstFileExA, 0_2_007CAAA8
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49728 -> 185.114.247.170:80
Source: Network traffic Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.5:49732 -> 80.211.144.156:80
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:02 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:11 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 31 Aug 2024 07:42:13 GMTContent-Length: 2284732Connection: keep-aliveLast-Modified: Sun, 04 Aug 2024 16:13:27 GMTETag: "22dcbc-61eddd738a717"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 80.211.144.156 80.211.144.156
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ARUBA-ASNIT ARUBA-ASNIT
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 384Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 2536Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1404Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1416Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1416Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1416Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1428Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1852Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 151036Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1852Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1852Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 1868Expect: 100-continue
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b HTTP/1.1Host: 951499cm.nyashtech.topConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: 951499cm.nyashtech.top
Source: unknown HTTP traffic detected: POST /sqlcentralUploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 951499cm.nyashtech.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: bridgeComponentreview.exe, 00000005.00000002.2127728325.0000000002481000.00000004.00000800.00020000.00000000.sdmp, bridgeComponentreview.exe, 00000005.00000002.2127728325.0000000002545000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2351469122.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2351469122.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2352287301.000000000244A000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2352287301.0000000002456000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://951499cm.nyashtech.top
Source: bridgeComponentreview.exe, 00000005.00000002.2143150573.0000000012481000.00000004.00000800.00020000.00000000.sdmp, bridgeComponentreview.exe, 00000005.00000002.2127728325.0000000002481000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2354876970.0000000012CF3000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2338588791.0000000000E66000.00000004.00000020.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2351469122.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2352287301.0000000002401000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2355427591.00000000124C3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa3
Source: bridgeComponentreview.exe, 00000005.00000002.2127728325.0000000002481000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2351469122.0000000002CB8000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 00000018.00000002.2351469122.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2352287301.00000000024BC000.00000004.00000800.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2352287301.0000000002401000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.bridgeComponentreview.exe.25a7c20.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Source: 5.2.bridgeComponentreview.exe.2545d12.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 0_2_007A718C
Creates files inside the system directory
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\LhMoEdVbIY.exe Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\8995e9fee2d9e2 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A857B 0_2_007A857B
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A407E 0_2_007A407E
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007CD00E 0_2_007CD00E
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B70BF 0_2_007B70BF
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007D1194 0_2_007D1194
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C02F6 0_2_007C02F6
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AE2A0 0_2_007AE2A0
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A3281 0_2_007A3281
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B6646 0_2_007B6646
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C473A 0_2_007C473A
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C070E 0_2_007C070E
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A27E8 0_2_007A27E8
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B37C1 0_2_007B37C1
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AE8A0 0_2_007AE8A0
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AF968 0_2_007AF968
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C4969 0_2_007C4969
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B6A7B 0_2_007B6A7B
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B3A3C 0_2_007B3A3C
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007CCB60 0_2_007CCB60
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C0B43 0_2_007C0B43
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B5C77 0_2_007B5C77
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B3D6D 0_2_007B3D6D
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AED14 0_2_007AED14
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BFDFA 0_2_007BFDFA
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007ADE6C 0_2_007ADE6C
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007ABE13 0_2_007ABE13
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C0F78 0_2_007C0F78
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A5F3C 0_2_007A5F3C
Source: C:\containerprovider\bridgeComponentreview.exe Code function: 5_2_00007FF848E52F70 5_2_00007FF848E52F70
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 26_2_00007FF848E92CD5 26_2_00007FF848E92CD5
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe 059B3F10324E5234E9D76365D78DAD2E6F9D807C75100F103C5CDC6EEFBAF464
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: String function: 007BE360 appears 52 times
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: String function: 007BED00 appears 31 times
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: String function: 007BE28C appears 35 times
PE file contains executable resources (Code or Archives)
Source: bridgeComponentreview.exe.0.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LhMoEdVbIY.exe.5.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LhMoEdVbIY.exe0.5.dr Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Sample file is different than original file name gathered from version info
Source: iwtYgAXvKB.exe, 00000000.00000003.2005286676.00000000077B5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs iwtYgAXvKB.exe
Source: iwtYgAXvKB.exe, 00000000.00000003.2004496699.0000000006FB3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs iwtYgAXvKB.exe
Source: iwtYgAXvKB.exe, 00000000.00000003.2004900886.00000000077B1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs iwtYgAXvKB.exe
Source: iwtYgAXvKB.exe Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs iwtYgAXvKB.exe
Uses 32bit PE files
Source: iwtYgAXvKB.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 5.2.bridgeComponentreview.exe.25a7c20.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 5.2.bridgeComponentreview.exe.2545d12.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, BDfwCct0e6rxD72tJVn.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, BDfwCct0e6rxD72tJVn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, b28LcQXlWL29YdhBc3I.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, b28LcQXlWL29YdhBc3I.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, BDfwCct0e6rxD72tJVn.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, BDfwCct0e6rxD72tJVn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, b28LcQXlWL29YdhBc3I.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, b28LcQXlWL29YdhBc3I.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, K2nSjTf3v80hCQ8USL2.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, K2nSjTf3v80hCQ8USL2.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, K2nSjTf3v80hCQ8USL2.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, K2nSjTf3v80hCQ8USL2.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@25/28@1/1
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007A6EC9 GetLastError,FormatMessageW, 0_2_007A6EC9
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007B9E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_007B9E1C
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files (x86)\mhsfzjqzciawwgkkzkgthjpnvmmjdknszupodvapiywc\conhost.exe Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\LhMoEdVbIY.exe Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Mutant created: NULL
Source: C:\containerprovider\bridgeComponentreview.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\e55a14eb5d2374c914989f91e2f3261ca7b60ebb
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_03
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\AppData\Local\Temp\WtSaPxMAJl Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerprovider\HWCHX7UinH.bat" "
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Command line argument: sfxname 0_2_007BD5D4
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Command line argument: sfxstime 0_2_007BD5D4
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Command line argument: STARTDLG 0_2_007BD5D4
Source: iwtYgAXvKB.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iwtYgAXvKB.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: iwtYgAXvKB.exe ReversingLabs: Detection: 76%
Source: iwtYgAXvKB.exe Virustotal: Detection: 61%
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe File read: C:\Users\user\Desktop\iwtYgAXvKB.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\iwtYgAXvKB.exe "C:\Users\user\Desktop\iwtYgAXvKB.exe"
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerprovider\WD8Tyzwe3aBcLS.vbe"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerprovider\HWCHX7UinH.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\containerprovider\bridgeComponentreview.exe "C:\containerprovider\bridgeComponentreview.exe"
Source: unknown Process created: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe "C:\Program Files (x86)\microsoft\EdgeCore\LhMoEdVbIY.exe"
Source: unknown Process created: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe "C:\Program Files (x86)\microsoft\EdgeCore\LhMoEdVbIY.exe"
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerprovider\WD8Tyzwe3aBcLS.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerprovider\HWCHX7UinH.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\containerprovider\bridgeComponentreview.exe "C:\containerprovider\bridgeComponentreview.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: version.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: wldp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: profapi.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: rasman.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: amsi.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: userenv.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: propsys.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: edputil.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: netutils.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: slc.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: sppc.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Directory created: C:\Program Files\Windows Mail\LhMoEdVbIY.exe Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Directory created: C:\Program Files\Windows Mail\8995e9fee2d9e2 Jump to behavior
Source: iwtYgAXvKB.exe Static file information: File size 1474801 > 1048576
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: iwtYgAXvKB.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: iwtYgAXvKB.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: iwtYgAXvKB.exe, UYOTATHKKW9YY9G.exe.26.dr, LOU1YTO9ROLERK7.exe.24.dr
Source: iwtYgAXvKB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: iwtYgAXvKB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: iwtYgAXvKB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: iwtYgAXvKB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: iwtYgAXvKB.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, b28LcQXlWL29YdhBc3I.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, b28LcQXlWL29YdhBc3I.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH System.AppDomain.Load(byte[])
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH System.Reflection.Assembly.Load(byte[])
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH System.AppDomain.Load(byte[])
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH System.Reflection.Assembly.Load(byte[])
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs .Net Code: nKGManHnrH
File is packed with WinRar
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe File created: C:\containerprovider\__tmp_rar_sfx_access_check_4567968 Jump to behavior
PE file contains sections with non-standard names
Source: iwtYgAXvKB.exe Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BE28C push eax; ret 0_2_007BE2AA
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BCAB5 push eax; retf 007Bh 0_2_007BCACE
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BED46 push ecx; ret 0_2_007BED59
Source: C:\containerprovider\bridgeComponentreview.exe Code function: 5_2_00007FF848E5841D pushad ; retf 5_2_00007FF848E58420
Source: C:\containerprovider\bridgeComponentreview.exe Code function: 5_2_00007FF848E58DC1 push ss; ret 5_2_00007FF848E58DC8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 24_2_00007FF848E81BD5 pushad ; ret 24_2_00007FF848E81C0E
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 24_2_00007FF848E8841D pushad ; retf 24_2_00007FF848E88420
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 24_2_00007FF848E88DC1 push ss; ret 24_2_00007FF848E88DC8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 26_2_00007FF848E9841D pushad ; retf 26_2_00007FF848E98420
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Code function: 26_2_00007FF848E98DC1 push ss; ret 26_2_00007FF848E98DC8
Source: bridgeComponentreview.exe.0.dr Static PE information: section name: .text entropy: 6.897489147098787
Source: LhMoEdVbIY.exe.5.dr Static PE information: section name: .text entropy: 6.897489147098787
Source: LhMoEdVbIY.exe0.5.dr Static PE information: section name: .text entropy: 6.897489147098787
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, bTOsu02xwUH1BNIIipR.cs High entropy of concatenated method names: 'wBQfqBujlV', 'uDOffIBojM', 'udQfMq8k0N', 'iPkN8AlstNyEvMVq6wp', 'KCXj82liTiVB3r5b28s', 'oQopnsl5DSuc17Jixev', 'BTf1jdl9T6JcjZtVsqS', 'kNMRAHlXb5gp7vx9f1c', 'pA4xD4lpO9o0fnfpWCy', 'BCX1t2lQd7UKO4Pmfq6'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, QBkHttjhBUkWj8Us7K.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'GQ7hJTyTC', 'jnmpmDYkB5XfeghVObd', 'mTGuYcYbgUgnbk23l7H', 'w6qqsMYFDyfa8abtJ7G', 'lJyy22Ye7nVv0Td8puc', 'fV5JD2YmpjXouXjCkON'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, RSs2o6HEqiBjwqNN92I.cs High entropy of concatenated method names: 'pwYVJH3MSB', 'IYwLrercVVG5RSB3GCa', 'PaLPuZrJPajnAmpqIsb', 'tVqwFFrQMfNv0ChqGY6', 'xTDos9rwKBivxKk4wQL', 'PGCGg7rz1dx2r39mbXy', 'r3DRRaPK0M6rug8KaTt', 'MOqT35PMoJ2Ti6yET4N', 'JaXn75PY25YKxnYuSMv', 'WxLT66PtKF3228cnJld'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, yKfSPltNBX7srNnRyiN.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, oXObXMnfN2QbvmTFFZK.cs High entropy of concatenated method names: 'DX2FOtDm5gV3vFoWJtS', 'VLHuMMDT4JHcV7pW6RN', 'JexUXVDFZ4ZPlmRFIho', 'oUcaqvDeB9jKIB3Nad0', 'FSP5W4bRDF', 'bJe8ZOD6Xn2vsiuUKvy', 'sIvtqBDUglf7j3dhMWr', 'PKbHciD7sfNw09e2DaO', 'sjaUDxDfNn6yPgnxRqp', 'IEGWKpDOFswL0gOa2wM'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, CilZ34t9xrbZWRLnVn6.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, plOnw3tAaEDpA5CVxmE.cs High entropy of concatenated method names: 'IGD', 'CV5', 'LmKFWDPsGW', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, rqLa5YHqNZqv5edIeJD.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'oqXV2pNkNC', 'YwtVv5Wgc6', 'TsfV7YGHYh', 'Fo1VYZRku1', 'gn8VZdx05j', 'M2HLufPNUAPfwM4ERRW', 'qnKqQtPlwsRo5C583qH', 'LIAbeVPIeqrpLiNwJcj'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, hDQE0OYVt4hXX9FvFuw.cs High entropy of concatenated method names: 'lBeLv0bqtB', 'zBGL7x2m09', 'wO2LYZOX6w', 'ooOLZIdkoY', 'JdLLhfPag5', 'XJCVexfJvAZxNk6BoBa', 'SFbLrdfzgGHFjymlpbX', 'vkM6fWfwHZI8mtddkiy', 'bBlb31fclgva5fXYobD', 'mL8U2J6KwEJc1fKUuHM'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, FPBaJQS3ytj65XBX3f.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'Qt46exYqpAQEeT5Ryey', 'auLvGYYR6CxwkVeItkI', 'qljHvbYLODKSlERDH4T', 'DQVsKpY4etbmTaLh0Xi', 'IdLrTIY2BBmZCrtkxQw', 'CAMB2OYAq8vOsZNsFv7'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, eralHetPHtua1ICGjBl.cs High entropy of concatenated method names: 'b6tF58ymkV', 'TjyFmdYDWL', 'L32FIZu0ku', 'TNeFgAkfrO', 'OA2F6icXIy', 'Jia1dREwMbViQmCLGsM', 'QRIO6GEcxuw3oVtgrTe', 'HEZ9cbEJAiaGrTXX8ds', 'aXGIw8EzMtCfDxp40uj', 'kvvxUgCKaXyFmJm6cqU'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Fao0pFXauoKJhVnU24r.cs High entropy of concatenated method names: 'dKwQ5JeNud', 'ybqQmonXhf', 'N3AfEpZ7Kdc14ApcSlp', 'oPdRb5ZmLmqfdv43uAj', 'Htb1jNZTrdfsHTytNKw', 'AWwBZjZfnODINtiAxQ7', 'sxNggTZ6GEsI2efiYC9', 'jHVDduZU1ZGM9xxn2pp', 'pxlbmrZOWpb2TyKvT1u', 'Xbba8rZgY3dkQ1TRoEA'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, JTPsfWtQpEaAMX6DeAu.cs High entropy of concatenated method names: 'pNIRe184ns', 't0vR4RSPym', 's27RBnujXL', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'gA0RL6faOy'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, HBmGmJi7MKqXBAMmBh.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'gaJyXC8GK7qpQg8O1kn', 'QUl3UB8ZUHcuZXvq61x', 'UOPISJ8VcO7pEEjqlwZ', 'vd1AoR8dODZW09hAm6r', 'UJ4JbX85X6VCqob5FJc', 'ykhUAQ89NXZbvK5TCeX'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, JoJMaR2q1qxJxXQWIQF.cs High entropy of concatenated method names: 'XDwqXvBbWP', 'TaCR0IlHMy2ljmclbXU', 'hWeOjTly0XG0GkbwrhQ', 'VBPaMWluPBxII2Nk6aW', 'g4RRHmljSxG8CI5ydgy', 'KVTyAMlvWOpRhmUOfc6', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, NRDZqxY6fWIZWP7reTY.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, VcdkYsfI9tveGvcSeVg.cs High entropy of concatenated method names: '_5u9', 'f6mSEpRElb', 'GFt4ysOrJM', 'ikQSnCAPIx', 'my7x95mw5iVDIB2WTAB', 'XRTRhbmc71BPEHK6IUt', 'CTXTdlmJsPUlMvRYFQg', 'dM5MmOmpIejE7BagZd7', 'gbAVDDmQG8TvTARMUyJ', 'KEb1sNmz2gW9xTKf8gR'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Oi65md23VdKm2gsOdXa.cs High entropy of concatenated method names: 'uvLqJqaGSU', 'kINfEeaPEsUTDFkEW0R', 'HF6bpha1NfiDtHvLfCa', 'XAtN2fa3pENSLKR3RqU', 'sV1sYyar9wxw8BIHigy', 'Y2Lp5rak6SpjN1i2pkQ', 'Cq5wX8ab4mR5EeL12YH', 'b3AOxeaFWyUiLpQhBVj', 'iviSuhaeQFZXSVhfSU5', 'f28'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, cvZr45Duvu8imc9MHv.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'xg7g2gtQ6JET0HdXxRf', 'ry7iKXtwZOPeRMyyN8H', 'FOhW6ntcC9ARromIjhd', 'SKmx3ftJh1YoTLhUsx7', 'yGAdhVtz3be3J4cFNJ3', 'HwxXG3WKUG9s4OlEcyT'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, ynkshMHGaDUKnFfiJOL.cs High entropy of concatenated method names: 'VOrwuSVt9S', 'O3MUcP19aH90kODDCqE', 'oLf5tA1d4hiECvVJwm1', 'RD4K6915dj0yTtC5yAM', 'OTGlgZ1sncUkk050twk', 'HFTkwm1iWAVFgBpw41A', 'yoawT2qeu4', 'cVfwAW5ZG1', 'WtUw5t6kQ2', 'qNKwm8og6m'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, NBcRiyfimHEJ4GSkLWZ.cs High entropy of concatenated method names: 'iRouiA7Hq3YdrtyV6KI', 'J46Kpe7yXHfVxfTs2So', 'efyRC97uou8mlZ0JWDe', 'FNqQ0k7jNI89F5c35YK', 'IWF', 'j72', 'g094k0A3WY', 'Cbn4jBKx0O', 'j4z', 'Pfv4T3eH7f'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, gQSinP71am3kqsuthu.cs High entropy of concatenated method names: 'jlkWNhwu2', 'vctuYgMl0', 'eD3FZw3X7', 'LasRgd0JF', 'QZRUNVnnd', 'PZeNbBvOy', 'Ln6JT2iFs', 'YMdxCJMaDOyyDDUruWA', 'UiQTdSMN4X85rOKRm69', 'O5a8F8MlXZo9Job50sr'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, a2jEEkfrDB4WP4rMyO2.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'EdrSfLbFLm', 'zT54GTwOc5', 'R2hSuJvjju', 'l4YW6nT4GdtBlD9rIKk', 'a7Uc3eT2JWrm7xrquce', 'zjxR0LTAawy7taC9Uwp', 'pavPTuT37ijv5YObbau', 'bK5dUaTrVqVAwo01xBK'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, F3BTH6JOoGUR1eqLpP.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'TgyOMP8XKUrXN54xRTU', 'Mwy0sc8p8N26P2NUWEt', 'zA45YF8QgjlRyQCZ0kj', 'iUGPPi8wrNMvfXGobju', 'hvFnrI8cZ9d2SkqVIbh', 'pT11q78JFWhmZovwdNj'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, E7EuKO2a12x1AttySy4.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'DuOFkmIkEn11LGXrurV', 's5qhEmIbVO3CDO56i61', 'a6hFx1IFi2BFq8hvh9r', 'e3VZ47Ie9jdygddgykf', 'C2vsQSImQXaBeEmY3OL', 'foKob2ITEQyVxRqSuco'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, VvbaXqYn5pQkkDSRWUM.cs High entropy of concatenated method names: 'rkiLkav0hr', 'UjjYiJf1FSk1YQxovxo', 'l4djtHfk3Yki7cVSirk', 'KKMhDTfr1i5bX3s67oH', 'c7BLP3fPmBEwnG5KU2e', 'Hch4Q9DshA', 'cBC4PlWJxZ', 'v6o4Cyraan', 's2d4KpRutP', 'e9M42cskHr'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, FgaXpf2XXae79cHv933.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'znJcccnpCLT6415rTIS', 'LU0bLCnQyZ7fDbVu5F5', 'JdrBMVnwURObLCCGhYT', 'WCJpNvncYQHXEOYig8m', 'gmE20enJ0bukiD1ToZp', 'IJmGCBnzNto0DDiYrYK'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, aGAwi5nRsvxKVSIyTL1.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'e9Eu6BURZg', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, xt9Vjl8QMQpwM1EqLN.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'TeEiSb3Ag', 'rcorhqYuNPXMGvFyClQ', 'WBCwDxYjBnbkNHDSYRZ', 'rI6WyqYHrp42P2TgbNY', 'wMckUwYymNKwXNu70Nm', 'GJWQwGYvJHZNbvo6tmS'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, CFAqGo22d7xt7Y8M2PF.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'ldaFZDnkGetqlDr2rPb', 'IIufVwnbTdGbqsPMB3i', 'CJpf8knFCFvImhV9uSx', 'cdsIX2neYKaOAOTjasW', 'HtbOyQnmblRI5ONjIix', 'p8WqDtnTaDgxPVRYlrD'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, EPJHvIndFfJ1UEHqw8V.cs High entropy of concatenated method names: 'k5VWS7Md08', 'H54Wl7LRQv', 'LCZWOLqVmb', 'MS3WxMi3kK', 'I7BWH0i7Mr', 'eXGWXdSYEm', 'xvsOmGHdU71P81ajR5j', 'pRqWGhHZUF3hxTYUjHA', 'xraN6PHVA4ccVbM4eg4', 'zyGZG8H5yPtXJjyCXct'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, J3AXtZY4Y9kDNWR832L.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'DQra1uhZbP', 'ERpanITCXj', 'r8j', 'LS1', '_55S'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, OS8OvfHvbpr6PiMJVb8.cs High entropy of concatenated method names: 'QmOMXhLyxm', 'eb4Md1H3PY', 'X6WiBq2kdFqi6p1iZgZ', 'u6MZI72bfs9qRqMPggC', 'frLKQq2FCUnGvOJCxix', 'dAApC22e8GTdYKFo3Zo', 'coM1Cs2mbp5Lyev94eJ', 'Et6xjf2T7WNSNyEpp7u', 'bFalga27bwEaD4Fs0P5', 'gI4GBN2f4PRFyG4hRei'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, cW3Y3EnKhM6SuvmyovB.cs High entropy of concatenated method names: 'UEHuGu2oFI', 'iTUuV7utcS', 'kvYu8IbgWH', 'unEuwmtwUp', 'SxFuEkcKCa', 'JHRueUG2TE', 'iRYu4eA8jM', 'XpWuBB04wN', 'jKquLB2EjU', 'ussubotnBG'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, aaaLqr2nT92mZBerO2M.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'EcMTVNnZE1EQk0Ce6ed', 'ktJULZnVoOTucq5dpxt', 'BelExBndZAOsMrZBu9C', 'U0xNCjn5PRYbrE7IQBm', 'iguNS8n9n4IdCZ8Kc1r', 'i9skwgnsEdQOAESpcKZ'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, uq1PWVnNftTa4asjIlR.cs High entropy of concatenated method names: 'wx6WZySaj8', 'UXFWh4liCv', 'VUKWpCkHj1', 'qbHWsFnwlb', 'vbDWiKtM5c', 'iChU79HO6rAoUiFFMoX', 'alkCp7H6CGtLaAmVDos', 'phH3GNHU9jZqn14K1Tv', 'gU8LhFHg1kw7Cwxew86', 'ePVV57HxyXMD4yvpdCe'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, dV5nhg267Y3YKev3ZhT.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'mJ3ZgnII4qoOjF8ExbD', 'QGX1yFIait3mdj1NaRQ', 'M464eQINmcp49c8Z1oN', 'nJqfXiIlRq1xJprqIIV', 'tXtS4uIqZkOE3behdkx', 'zMvKpQIRmfnhbJAMP4E'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, BDfwCct0e6rxD72tJVn.cs High entropy of concatenated method names: 'eqLurywHuM', 'jbNu0Qqff8', 'HFCutgLYtB', 'bdBucWMAap', 'Oyau9gb1SW', 'k55uogFoRI', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, p9BsUnYagYO97QgZ4Jh.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, oNjeAJYJhPVEfCynnoP.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, dYCI2bY1iOPg19UIsgZ.cs High entropy of concatenated method names: '_7zt', 'qM4bAHVBfM', 'z0tb5g8lEX', 'lDybmNwvv7', 'Co4bIPix82', 'bTDbgN7RSU', 'xsbb6C6yNT', 'AnTU706mIsVp0T9lcur', 'OoeFBZ6Tu1l1qa3uEuq', 'B7pV0R6FsDPQlet6coH'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, jtciwggrgHlUr4QiRL.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'YPsxiJ8ADRRKLRsneqn', 'dE2CZA83A5R25NESand', 'fVEFr88rKYI86h23aoX', 'ABYK2N8PBCNScwsNSYF', 'bwCvEB81NtJdKRDj3HE', 'XisD2T8k7YBBUuxWVgy'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, KQLb7kfPJlQhLRj0bDX.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'afcVdhm46aZiGN5FqAF', 'WH8TmPm2FirUb8WRbCT', 'TahaWPmAgsIVfIN7iE7', 'G6kriam3drXHZexNI2R'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, bERWuifwIMMInrGGWo0.cs High entropy of concatenated method names: 'WM1EKsBbgH', 'XMWE2nrdum', 'zcVEv5rd5X', 'JF4mTfF29vOguPIhLCb', 'wN2OfJFLCXxSttmynXU', 'd4v5ZnF45EwFrgqv02L', 'Dj5IgeFApm5CNXHmdWr', 'yD1E11XFDT', 'Ir1EnlhKlH', 'MdSEkGb5RA'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, mvigG4n6GGPQkvwx1B1.cs High entropy of concatenated method names: 'cnBW52LSuk', 'VrPWmLA0rM', 'tMLExNjXh5O5mvYUIXs', 'Off35mjprSFu8LZdfBV', 'hWP10FjQEyQpyMjxGC0', 'TRCj20jwDfJpwQoYnI7', 'NA6t0ZjcFBKdyPrfRV7', 'fwrntsjJmpPEdXaMfQn', 'Dhe78bjzoOGBdsSquCP', 'SQvPamHKvYPCgZGINJo'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, XVSfWlfoo0BQYIwBbBN.cs High entropy of concatenated method names: 'OEYEiqlal9', 'eJCE3EQZVQ', 'aUMErbGcQt', 'DJfE0vGPu5', 'mCfuL9FBQnQvqhmIT1h', 'Sr2OpeFuIhQjdjHJupg', 'cN2qsbFjAZPHwvX4ghq', 'p9O2b9F04brHfr0eYQg', 'fY2rhAFDDffip2lYV0N', 'EJxkXtFH9H5tKZY5IRi'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, xKKKsLHQArVV9O6dwsa.cs High entropy of concatenated method names: 'IUrGXrguOg', 'X81GdpoBte', 'Nt4Gz7GShK', 'FS5VyVkCOC', 'sdpVqt7hDI', 'EBRVfOS1ax', 'S3nVM8WEwQ', 'KdPVGvZ37x', 'PEmVVsfW8q', 'fIWBSE3pXVfC3W1nmtY'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, dvKP6X2l6wGx5LOBwyE.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'yatw35IiurMMtZAFplP', 'cItkFdIX33Y2rg7jE8S', 'aAglLLIpdtG6NOq6dDW', 'o6XfjmIQlpMhy3ZJ43s', 'W4qGhEIw3FpyRrxJccE', 'xlY91DIc8EnLdknVlgB'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, zmDk3CflsjLre0EB5fw.cs High entropy of concatenated method names: 'LPsEcWILvd', 'nGHE9crkKu', 'AqXEo3es6x', 'pfyyrkFZOldKDoBOZmo', 'zQXl0oFVB7mR0F7pnww', 'OI0CtJFd2Xh9EpJ5iNV', 'DEV9jcF5T2LOQvNhpfr', 'kwV6NYF9Ta5TGEG6LHL', 'cpsaiiFsq1trm0pnai5', 'nHnwXCFiAgWX9PCrrLO'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, zUYrjbYv5QjHT13f4qn.cs High entropy of concatenated method names: 'jAabGwTjAg', 'Q4HbVHevLM', 'B9Gb82Qa0W', 'mL1HsQ6rVsojpKbdMyD', 'hbXsio6P5XEJtkdthIK', 'qcYDdf6AURpqRZCbaKw', 'bmneuL638f2vZjZ4Xi9', 'uHmGlN61XCBmH9B0BBw', 'k2pNT36k1efT9sjLsWl', 's77AiQ6bmSuD8vVYNMD'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, wB2eiPHDvDUSvA8atUD.cs High entropy of concatenated method names: 'fWW8EsWFa9', 'oR78ec5DuH', 'nWhSovPpXoPmJ12DtC7', 'PQDBvoPQio64EUb3LTW', 'RZSHHSPii6l1hvXcmDU', 'ij85fHPXgTQPwtfJX8N', 'QB58kBvdQT', 'v0INgN1Kl5OBmtTHi2e', 'yRDXhy1M1PMB94kBl0B', 'JsJ3oPPJUDgLDWDYnmd'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, fNIrkv2ixeoQbPSev9W.cs High entropy of concatenated method names: 'g5pfAeQpQp', 'rfLCQQRnmgwnUgat6Lm', 'Y821bDRI5AV340C1Hg8', 'AVhUu5RWnyJiGC0vdxK', 'H8CHKaR8XS87iHyCO9j', 'ODUFPuRajCjYoRSHljO', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, cONEsitFE6J213R7R97.cs High entropy of concatenated method names: 'YcBNYd0rnG', 'M6O6ghoxO9ht9KPmXyd', 'XADa7bohqt53rTUSitA', 'pkyduAoOSynO0xeHP8k', 'EuN2G3ogbiYW9LuVIYD', '_1fi', 'OHEUoFIoux', '_676', 'IG9', 'mdP'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, mvoIo9Ho2tEWuYV8x4Y.cs High entropy of concatenated method names: 'NYTMx30bpH', 'wQPlAk2t3wGi9PABmXX', 'nCZmSY2W4824b7O89aZ', 'TrXiLJ2MxLjpCkF2ihI', 'xGqJJD2YYNsaBxLg1mI', 'NpeycU28L1JTOH2OuWr', 'PghNvR2ntwY7vaVSEjF', 'KqlAyY2IthkayPAL2F7', 'gjWSfT2ahoUMCF3r18O', 'mJ1GbF2NmOhRwlgP1MD'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, khPaFg29t0NcowrfCYi.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'n8KrPIaVVE9Rsfytdnd', 'Pf8BbaadZKri5Fpu0bK', 'cNSL4ma50s9G6Z3oAAG', 'lrlUfVa91ZhEI1wKcDb', 'CWkGbAascAMFJoNSyOm', 'YlDlFMaitfCW8IIK3Kf'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, CFEP4nnCZVdQRDBExsB.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, IcR4PoqJoCLicUPMFK.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'zSKQPRtjFnNw6fguOye', 'zPuwZQtHepmogdn23IH', 'lxgqhbtygNwe8gv813y', 'DHfHaGtvkQJZGsJ1nLj', 'ic4yAPtE3iGRgJevpkN', 'JnDm1EtCkF0VaBhQhVc'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, G18cvjYsPIhZKg9tSsC.cs High entropy of concatenated method names: 'ROpbKeIEht', 'bAHb2PhNCM', 'GpYbvIo4XB', 'mr0b7nS9it', 'N8hbYlui5a', 'IZ90AV6u8v20GUgS5SH', 'w5qPFY6jrIo8FubtgAk', 'hRrcEx6DJge3LsIlOgX', 'brYmj06BgUKfApwr8ku', 'ioYR306H9IMmHjZRQKq'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, gPGcMO2gAx7FVc3Iccg.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'Qb4vIbq018xTxERfhhs', 'QAsA98qDfe5Tm4hHBrC', 'KHEcXmqBFEwLDcBSCp6', 'GXJerPqu8VEjNeaSvjA', 'X9dbsWqjBWLlm0VOTOH', 'd6EWRmqHwc7JDdkKDK2'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, NfM03DX0npGwIBhROl.cs High entropy of concatenated method names: 'TNlDbcPNg', 'gVhXKPDEOMjEIPUpE3', 'FSYpIdhYIKo9xsRGlr', 'HCmyCZ0QOdmDJZQU7i', 'iYPnd1BT6trl0TYXhL', 'u5XlI4uT6kkoMCFGjK', 'f48fvXm0B', 'hq4M7eMYR', 'R4DGhW3KB', 'PmiVKMjug'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, NDndyI2UGErCG9lN0dN.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'tlhrwnqF1TC8qAa8VZs', 'arbnPdqeDiqHBU3P15S', 'nsftC4qmYW3YGPJ1PwM', 'rA9JbtqTP80CTqW3EXy', 'MsNDwGq719s2ZAQ7Erj', 'vFf2YuqfCNX1e3frYYr'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, luiIaYrihW6QvBxS2K.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'l3FDeMWomkdZ2lV8Mdd', 'da8wLvWGnbIA34aTvVI', 'mGnTW3WZ9Qku9iY6ptn', 'nfKLR9WVjdR214KvHXw', 'uJyrDnWddX9bLUnS7L2', 'qaGZuGW5DWJZIMDrqpI'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, S69INZtHSn6xNdkX6eF.cs High entropy of concatenated method names: 'P6VFEXLWrv', 'EjiFeScZSd', '_8r1', 'FXsF4EnRFL', 'FIwFBIePkT', 'aQmFLb2iNM', 'mgRFbf3jsi', 'CfSSlDE3ejfCApwqaGs', 'ut8N1PErsuKs7YlvUhu', 'Q1efUrEPd2sloGCAajA'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Mx6vSa2ogEGV8VWKrcN.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'bbZc5ZIvyArm2yK6eOQ', 'aubqXaIEsGidEMUujCQ', 'bdi9FjICRWPr9KMXqoM', 'lLdK9RIS0tgMgM0QueF', 'W8AYsKIokBHyNHdOv8R', 'zAYesyIG4IXAyTc0vxE'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, knZiF92uiMYVJHIltG4.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'ubX7kmaKRT2sol4A2By', 'nwNGjNaMeFdehi9yyJK', 'jyXx0eaYylKkR4y8frO', 'rM2WO9atlA9olGHeOQt', 'h5mqPlaWNpF88ESIqJ4', 'GLTy7La8d7Y4o1bHYTT'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, VpnlnJI4Ex2OvOMeG2.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'OB7IFcWPwvONZrV79es', 'kDOWhNW1hhHWM3o6ZnG', 'sim4tBWkcvMbE1b6jEf', 'dh5nyuWbUkECN96tfOB', 'KmtXgQWFegrQBoVTNMv', 'kTZnnuWeoiYE7syNFDy'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, dQvlNK2POoSwg4haRpo.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'SYW9FSa7iS7VThqp0xa', 'Ir5aKXafj7LnSndksdr', 'i2nsYRa6sXG4DHFFMCK', 'EJ9U4OaUIJDeqChL13w', 'TrT2Y1aOeYZQx00cN1L', 'z1EZmLagG4LYAKF1LbI'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, eErudoLKiUsDKeuZ8N.cs High entropy of concatenated method names: 'UNh2JgVHh', 'OouvLrXxC', 'XyN76ph4U', 'FhohrsMycy0SpIvU1hy', 'fZ378YMjZ4VCUl6898G', 'hUI9sUMHYXK1wDM4CXN', 'sMlwtiMvcZJTGtHwMHi', 'bXKIGfMEH0cPps0s4aM', 'nbY8sjMCvoGFgVjixKh', 'HwYUuGMSOAEHpr3UihF'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, h1d0uX2VntjH00iAbGU.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'Wu39n8IU0RiBBL95Tm0', 'DVR64VIOLLsaPrSCqDb', 'PJJL42IgRkVudjUO8Jh', 'etPBT4Ixhdg4RC2vRfb', 'J1qrHZIhAyrBVRh95lu', 'lJN7keI0JKvXwknGjS9'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, quC7xUfgOLo8MSf770w.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'Dx34B9a33G', 'HZNSMTxAU0', 'hIg4Lk2rpl', 's2MSw2Gwcs', 'bgrXhZTySFuhqfCWjE2', 'esZaBrTvtEdyhe8sQVT', 'NvRoPQTjTdBYKPn9Odj'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, VDJubHfWFSlxx2NCZUc.cs High entropy of concatenated method names: 'AOIeCWvsZ6', 'gOHeKS1uQK', 'Ty8ojYm1w5d1CyibHVT', 'k7uO3HmkwVDIAAhsRIu', 'VS7G6QmrEFVn1CD3YDc', 'qnO6kTmPKeZ8bncFo7V', 't9LcElmbbHpr4QUt8Ah', 'XoP3hUmFROlqanHkO7C'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, LDWFyVt4ljbby3oMGgA.cs High entropy of concatenated method names: 'rxqJgWELYP', '_1kO', '_9v4', '_294', 'VZMJ6iKLPB', 'euj', 'rXYJWRejUl', 'QMhJup5VXF', 'o87', 'MXgJF9ReHn'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, MMpiQTHbhBXb44plkcK.cs High entropy of concatenated method names: 'aVYGDKxPIm', 'tGNGaO72fp', 'lMnTyIA7lo8sisyXNnZ', 'QyGBiXAfNHoYb4LbIC6', 'zUYKYNAmVldWwXwljlU', 'oaSDA9ATBiABfVbsITf', 'Mle9I7A6Xxrlqhi459I', 'Vy5QGvAUUHJtf44cZVh', 'K2MAHDAOcXa1bUwtwMs', 'NNApcqAgVBOr0gxQTmq'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, MCCVu7H7bilPFDLGZh4.cs High entropy of concatenated method names: 'sAgGmsSsnH', 'mYxGIpEc50', 'uetGgqTHMs', 'zfvG6lvjtb', 'qw1GWVV9C2', 'WSBZeE3KRmVXbs9CEn2', 'qqT04y3MkqQfkWqZtOC', 'VeduJmAJje1kOmDLZde', 'MMeenGAzQTpP8093h7r', 'm8Qp9c3Ys0mOQhCI4Vs'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, URh0042ppgdA5iMg9BT.cs High entropy of concatenated method names: 'dYXqrvmafp', 'uOKcDslY5mNNFtbYrar', 'eYsRBJltuL74FRYPyAB', 'JmqVXvlKxeqlknFDd5f', 'N8d2uglMKqfNfV9JDyT', 'X4bOAylWffmtZa4puuu', 'l7WxiUl8Cv4dDn9aele', 'ccNwtTlnbPGLlkdM59v', 'De2qtalXBP', 'Jxx9wqlNOmR6B34Dxvy'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, KU4EFYfz1Z9iqC3UtcD.cs High entropy of concatenated method names: 'Bs34UN1Dqm', 'Rfw4NZIWwV', 'xDQ4Jg8EG3', 'ArfloL7Cujt4c6pBaYP', 'mNtl8e7S2TGHsWQmVgW', 'VdxsSE7vq21LA5SBY8n', 'QfUHWF7EHDMYH5SyxHk', 'CLIX6o7oCxuOGkGVxxH', 'BEbgT57GhdPnX0HDnMj', 'wD9hs67ZDs5mGiI48dm'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, x49eL05NWaO3S1ThX3.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'l0DA7P8OitclKRqohMu', 'iKnaYT8gEoyyfetPcRj', 'o22hqS8xMxxYMAGZXNB', 'G73Vgs8hxV2rxWLPeag', 'dTO7Qo80CDrC4oa23kN', 'C1fccS8DtA90XuX2cxL'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, rEbNNa2rosaZ3rkOGgV.cs High entropy of concatenated method names: 'kVTfBhDr3K', 'v9EfLrXLkK', 'hleeavqRbxZ1A6gQ8oe', 'AYVTYZqll1MKfcXAj74', 'kCQoe7qqAw7Fs7H3gG0', 'plXMkZqLaDwxjF3SVOd', 'j4A5uSq4RFok2IteyU6', 'z35vTwq2wFnbr0rKUUh', 'AvfLkUqA0bKJOd3e7B9', 'AdQhuEq32OSkwVsAqmS'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, wT8t5EfYZ9RNODF4Er0.cs High entropy of concatenated method names: 'QpKws7nlLF', 'Jm8wiYioBR', 'Mf1w3KLDjR', 'VjJwr6kor0', 'IbKw0k4v0u', 'Xhnwtp6Ik6', 'KkXo1XkgloF00nZ49iS', 'KWk8TgkUUoEMY2f3Mul', 'HdxdIQkOLs74nTMZ08m', 'bWthsNkx8KWIh5q8dSB'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, lvxru9XSYHmfybYDoQZ.cs High entropy of concatenated method names: 'pNGPCesAiA', 'EC9PKLCxRu', 'qeVP2iIPF3', 'tbCPvociJ7', 'OvOP7AV3NT', 'yYePYOcyJD', 'nhmPZZVOcl', 'oImPhaTZyZ', 'uJTPp26SYn', 'kanPs4NU7h'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, bFgWDvHHF4lHUqiHEcs.cs High entropy of concatenated method names: 'EmNftWjn2r', 'LDqfcJIkqo', 'Wu6f9x3sbG', 'GQtfoxarEa', 'q47fSD82qp', 'CclflsZJX1', 'SORNRXLP6TBK2kUkMoe', 'D8C6qsL1b6wyDLEf63W', 'K5wVNvL3qJaYBamlyAM', 'Bfi3umLrJIiJZOwjUxw'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, ViwSJczHrVXyVcxQNg.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'co1nk1ntb0BpOTLUTX2', 'fcYwllnWxgUlMuP4ZIq', 'gDQZykn8n1rL7N7kST2', 'P8HpVonnCIkJiNH9jRg', 'TjwyngnI10sgjKH3MkL', 'I9yLJOnaAv1vyxPxJPg'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, yxJnlCnBxDVLPLJc3gA.cs High entropy of concatenated method names: 'bovvYby8iYe97FZph9E', 'cvyVP1ynF7CbA0hmVhT', 'v7L8IhyttJBXc5qy1bl', 'BWK6Y4yWCSjs6kws1BF', 'cBwhSryI2lbGRAKXDu5', 'siNZQEya7xc0hQOCOf2', 'Co3lB6yN9fjNISZGwbL'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs High entropy of concatenated method names: 'HDlMCtkhtM', 'LQNMKsOL3N', 'HpAM20ktpo', 'tG8Mvyi5s9', 'mxDM7WQ1J9', 'jH2MY6LBoL', 'KEyMZxGbwr', 'flY7kJ47Rc6cKQN8N4I', 'bg2D494mWccramX1WgK', 'lud0n64TUg9yUr6RrpP'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Q1Q9qcUUN5GdH1kJ4V.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'C3Ql9T8nT5BGRBPVQDt', 'kJ92pC8IbVR6KFMguSL', 'ENEjP98aAPxs2NmkCQx', 'w8u4fQ8NeSnkn8ikEPL', 'MkyKOI8lrXqpnIvc2XJ', 'I2RlyO8qYyNiy9yfxtq'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Kc6f4ufumZWiE26nCKN.cs High entropy of concatenated method names: 'M5BESBQeLS', 'HVHElkTEjn', 'ScbEOhe8x6', 'J0FExJ1gHv', 'vVnEHKLaq9', 'RB388henlAkYucTUjgZ', 'XvsVfUeIENQ3KUVW4jU', 'CRSl8veWf3G9wHPEmZm', 'QBGcDIe8JhfQsgNUbeH', 'Roit1gea0h4BwjH8e8H'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, b28LcQXlWL29YdhBc3I.cs High entropy of concatenated method names: 'nIdYVwZ5D3Ooowayjn2', 'y4YvvMZ9wQjNP65FBdb', 'X122kwZVPymnrB1qM0b', 'AFABNjZdm6TSo8eQfoj', 'VSxPIsVdXr', 'CSIHDSZXNMVp6UJRq1C', 'rUXmrWZpkgupcbSaycO', 'cQeGKaZQJ3Ol1hIwqm2', 'hEKyVoZw6I5uyhbbtdU', 'T5LvuRZcvoibJwPbUkn'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, UmeiCsfMPAOlxMZO3cb.cs High entropy of concatenated method names: 'sg9', 'qqJS8AXHNY', 'K8IeXJowxf', 'PdnS5Mt83R', 'FRYGeBmdWDwaQXoOdDs', 'QA2TWUm5FVoKh6eLTPc', 'O16g36m9NrW9YIYdIck', 'n1y8FAmZVpJJUdHGGOg', 'GsW1kKmVObFIBeB6AJl', 'WAIgvTmsltM76RPZl5L'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, UMn8mT2ErL7Bv2yblRk.cs High entropy of concatenated method names: 'deHql3ksZT', 'hGaH67l7gEAXCvYLExM', 'x3gJYTlfiPxpWQLKoV8', 'JRtUQMlmdAL3uJebbTc', 'Cj6wvTlT6wQioObnYB0', 'Do2V9vl6kMQGiMILZfD', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, FXLOnaXe5tGLs0pXtLv.cs High entropy of concatenated method names: 'iaWUwDee28lDa', 'QZ7fbBZuURMwBL5OL9h', 'HANVuBZjTPXlC91lrX9', 'jFRRsuZHZEvO8K9qld3', 'od8HqqZydNAy6IEqheR', 'BYZPgAZvNuMpPADGCqp', 'obM26YZD5N0DJVl9H72', 'ewsOiXZB5WNO0HDOSM8', 'gerJ7dZEME2eFFuicGc', 'HXSLLVZCD8VNfJDGEpb'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, Fq8SX1Y5Q0gZc3KsXU0.cs High entropy of concatenated method names: 'TxXaXfbmGK', 'zWpa2U9wfZ', 'IJDavuBxoM', 'nkOa79hXRt', 'tPMaYmZIwl', 'Qj4aZageCP', 'SejahIkl4F', 'xxZapruTtj', 'bY9asutTsF', 'CaSaimObx6'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, znbmhi2N5l9vFUrsooT.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'uZo7V1aJ6e5Hb6VlRwM', 'abn28SazIICdeQbflLo', 'VBgQW3NKIwqdjqouubV', 'UrqiCFNMHv3Fb7JHqnu', 'oS4AXqNYcNJBxflGnc8', 'PgN6eGNtYlYXmkB9sFf'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, rwPYK92f5KgyQHEEiBt.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'B3cclanxNvojWJhmH0W', 'rMiknYnhVsCpcqqGEuM', 'HWsL8Hn0o2wI6LmdwXt', 'esfl0rnDU65rLJ9xAIS', 'R3kmmFnB4n2FWATpjBx', 'HcqgZ8nujw1O4AgpqJY'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, LxxGoRtITNhbe6jlBUq.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'UW1JeEncHI', 'USrJ4fA2Gg', 'FEmJBxViWw', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, h3G8NvMLOQ3rqVdQMo.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'UkAbhyWq4jgkcepAWkn', 'SIRJwLWRl4GW0yWWb6c', 'lgCmTSWLdhraUosytxd', 'A2HFAJW4iDJCmY9FLEv', 'pdtK7QW2pHfvxpksMB9', 'vv6OlDWA6bMo7Ml4pwI'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, ssYtKNYibVAFYO6hawI.cs High entropy of concatenated method names: 'nhV1u7I8Ag', 'OwS1Rdv0J7', 'Okq1DH3MeM', 'BcC1aVy2Qe', 'bBw11ATvSY', 'koW1nAEBNB', 'sKj1k2DU9C', 'kEM1jJj27g', 'Ddr1Tu5NId', 'KdM1At73hy'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, F13bmCnpTR1Zdv72Ufq.cs High entropy of concatenated method names: 'NVBWtICNQl', 'TGoWcd7g38', 'EHUW9fFfTV', 'vwacWUHEWneuk6aeN2l', 'cD3M3nHyX2s5X39DqFj', 'pk26WRHvoFBhMCJ2N2Q', 'v0Yx24HC2xlOmc0lcDB', 'T47b12HSiQpmrdCwS6e', 'Wx8IOxHoO15NIpbJHWL', 'hgTurLHGHenhaEOB5ww'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, h2QUdbtt93dPfZnFNLb.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, kg3eUEyh2PoNjZFl06.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'n9HeRpYcMU035uNb6Lq', 'XBIX2OYJVwLb1RNIpt0', 'fCOoHMYzOv47ifoWm1E', 'FMIud8tK2MF3tp94Hqv', 'zXosAStMcuHWod7awKT', 'gxl0TMtYYIehoshRVhi'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, QWwYdPfV0VnBNFFqJlK.cs High entropy of concatenated method names: '_223', 'ueEaVgFPIj1yb5wuhVN', 'kUg9ADF1iLukP8hUeoj', 'OGXbKlFkTkC1HCrtrOD', 'WaJcgUFbeIognvxMYDh', 'fAEVVlFF9Yopmt56C2B', 'g3eA25FelPsybb7c0J4', 'db3Jt7Fm0BFMWILNRwe', 'tGi4u7FTRnOEqbO77A3', 'L2GsDQF7wHMGPlklMEA'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, OWPJ6G2AqRg2xPrHCE3.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'vItfndauHMuErVbUkop', 'hU1PA8ajETcnCL9OoOC', 'dyBrx7aHoLD7KPqX84g', 'RUDxPUayupTKxybxDs3', 'gNLpvSavDaamK0ubGT7', 'eweLOmaETdmEFGFrTo8'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, JHZsQ0f2hPd97IkOR0A.cs High entropy of concatenated method names: 'O7VwJKCYN0', 'y5AwQ8eJPE', 'rBlwP5uPhh', 'p7AwC3a6hm', 'ANmbD51zD4ggq6GFjFe', 'ntyqFP1c4jCJ6po9lm4', 'bBKdyj1JxXAu6QpSh2l', 'xYhnAdkKSHphdTYk1fX', 'dAgfb0kMWjyK6nrSJ45', 'IvhJHZkYlFsAUEUV6fU'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, K2nSjTf3v80hCQ8USL2.cs High entropy of concatenated method names: 'QdXe1nAqa4', 'lNDen0FRIH', 'OX3ektki0Z', 'IcmWnFeoOS9GGQ6FWnJ', 'rMtXnWeCbqBq3YeSQlP', 'WW9WlXeS0u9scjlbOKr', 'PhlI9VeGktl4FWsPtt8', 'hwIe8hhFJq', 'q1IewqVXjD', 'e1qeE7umK2'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, dVDfJHYWRWJAZNa0ei2.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'IbZDySXkSt', '_3il', 'DyfDqN1Csk', 'HO3DfiC4jU', '_78N', 'z3K'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, rU8DGtt8LOjBhZI80gm.cs High entropy of concatenated method names: 'EbBbX0oW2SachgGNkQb', 'XwCENgo8GnnyQJKa9Ow', 'WsPgLUoYXaTgIq1IAMQ', 'DkcQAKotX1JApqL3CwL', 'SWrR2Ia3AX', 'WM4', '_499', 'w3MRvjKCv9', 'dH1R7n1b2e', 'duIRYaD8Rq'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, IvaO7T2Qifh2UyZOUDS.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'ugwh7iNjwJrSn0QMChT', 'GtATy8NHWUbqWt46q1f', 'RZTWwnNyvysf8BYSpen', 'HaMlydNvFcZD9lHNU6O', 'uHP6KnNEdTr5C9GJmxW', 'BryHbmNCFvGaPCouiLX'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, NJDr5DYNBKMC1Q23jKN.cs High entropy of concatenated method names: 'mbsDKgZBTx', 'tiED2FeDOO', 'lt8DvoCLQl', 'E7hD7gN8tX', 'qCiDYEVvRQ', 'rivQICUk2E0p6SJAHdm', 'o7gW3GUPnb31fl3aIXC', 'DTx0sBU19L7Pyq4nM81', 'XnAkNJUbopYUfxR7Q38', 'jSXxtpUFc8ZH8hCSjLo'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, KhvwZpH1voaFaRemOI7.cs High entropy of concatenated method names: 'srlMz2Oy0i', 'OoeGyASNtt', 'qqnGqrp69Y', 'IeBGfrHaD1', 'BJDGMHJoRn', 'MWEGG9V5QZ', 'xRbGV9F2mL', 'McuG84KYla', 'rl1GwUGs5t', 'nNtGE5Yi5f'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, CLaZrEtjWo1ta29pEY9.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'mYvRuDTXFu', 'MiZRFFVc3R', 'kPVRRTHn2k', 'ipBRURvKmQ', 'HH0RNKcCWO', 'qQaRJfNY2t', 'GljTfXSHNyMWUurR2lC'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, gcmTyj3QBltYkNEkyy.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, a7FkGr2G58wCJ2bx8Ao.cs High entropy of concatenated method names: 'CkBfgjAgRM', 'yXNf6S6uMO', 'iX6fW2D9ir', 'YX1jpFRqQsbpmslkewY', 'bVwu0pRNufQexhZX6Cr', 'OX5w7ARlTf9gcBUmarf', 'eDDjp2RRqAvRNNm1QpU', 'TkWIWFRLQqOqjdpxjOi', 'VpZcX2R4b1HSKaOMQau', 'Ut9m89R2oSiK9PhIMKY'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, HIVMdFnGTlLOersS2YB.cs High entropy of concatenated method names: 'UGauUTTUHx', 'D9ouNhDZwp', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'y6IuJyqQbY', '_5f9', 'A6Y'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, EBf87KH0kQNjngNyJMG.cs High entropy of concatenated method names: 'V0Xfu2U6r9', 'SUhfFCbq8m', 'uCCfRx7TjK', 'aASwaeRDfICuFJNfyx4', 'rLbHGsRBiVSyZZsrBo0', 'WypQy9RutFTru4tRimD', 'mBPpSwRjSC1MDiqVBPA', 'RuuKLtRHbH4EiCaqT1l', 'uhk9OgRyhwHeGOY7d5N', 'xC8VvpRhOao6CVaVxm6'
Source: 0.3.iwtYgAXvKB.exe.6ff93aa.0.raw.unpack, YCfB8yfUPnaOBb4rNGU.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'pcoSvQMNOw', '_168', 'kMWiuHTfAieirQ1JPfQ', 'J74b2eT6QOqSSCi0Zi3', 'jcaBFyTUF83l8mhAOwh', 'M2P8FSTOTh793JWSkVq', 'g3c0QRTg1xT5iBonOpO'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, bTOsu02xwUH1BNIIipR.cs High entropy of concatenated method names: 'wBQfqBujlV', 'uDOffIBojM', 'udQfMq8k0N', 'iPkN8AlstNyEvMVq6wp', 'KCXj82liTiVB3r5b28s', 'oQopnsl5DSuc17Jixev', 'BTf1jdl9T6JcjZtVsqS', 'kNMRAHlXb5gp7vx9f1c', 'pA4xD4lpO9o0fnfpWCy', 'BCX1t2lQd7UKO4Pmfq6'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, QBkHttjhBUkWj8Us7K.cs High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'GQ7hJTyTC', 'jnmpmDYkB5XfeghVObd', 'mTGuYcYbgUgnbk23l7H', 'w6qqsMYFDyfa8abtJ7G', 'lJyy22Ye7nVv0Td8puc', 'fV5JD2YmpjXouXjCkON'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, RSs2o6HEqiBjwqNN92I.cs High entropy of concatenated method names: 'pwYVJH3MSB', 'IYwLrercVVG5RSB3GCa', 'PaLPuZrJPajnAmpqIsb', 'tVqwFFrQMfNv0ChqGY6', 'xTDos9rwKBivxKk4wQL', 'PGCGg7rz1dx2r39mbXy', 'r3DRRaPK0M6rug8KaTt', 'MOqT35PMoJ2Ti6yET4N', 'JaXn75PY25YKxnYuSMv', 'WxLT66PtKF3228cnJld'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, yKfSPltNBX7srNnRyiN.cs High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, oXObXMnfN2QbvmTFFZK.cs High entropy of concatenated method names: 'DX2FOtDm5gV3vFoWJtS', 'VLHuMMDT4JHcV7pW6RN', 'JexUXVDFZ4ZPlmRFIho', 'oUcaqvDeB9jKIB3Nad0', 'FSP5W4bRDF', 'bJe8ZOD6Xn2vsiuUKvy', 'sIvtqBDUglf7j3dhMWr', 'PKbHciD7sfNw09e2DaO', 'sjaUDxDfNn6yPgnxRqp', 'IEGWKpDOFswL0gOa2wM'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, CilZ34t9xrbZWRLnVn6.cs High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, plOnw3tAaEDpA5CVxmE.cs High entropy of concatenated method names: 'IGD', 'CV5', 'LmKFWDPsGW', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, rqLa5YHqNZqv5edIeJD.cs High entropy of concatenated method names: '_0023Nn', 'Dispose', 'oqXV2pNkNC', 'YwtVv5Wgc6', 'TsfV7YGHYh', 'Fo1VYZRku1', 'gn8VZdx05j', 'M2HLufPNUAPfwM4ERRW', 'qnKqQtPlwsRo5C583qH', 'LIAbeVPIeqrpLiNwJcj'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, hDQE0OYVt4hXX9FvFuw.cs High entropy of concatenated method names: 'lBeLv0bqtB', 'zBGL7x2m09', 'wO2LYZOX6w', 'ooOLZIdkoY', 'JdLLhfPag5', 'XJCVexfJvAZxNk6BoBa', 'SFbLrdfzgGHFjymlpbX', 'vkM6fWfwHZI8mtddkiy', 'bBlb31fclgva5fXYobD', 'mL8U2J6KwEJc1fKUuHM'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, FPBaJQS3ytj65XBX3f.cs High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'Qt46exYqpAQEeT5Ryey', 'auLvGYYR6CxwkVeItkI', 'qljHvbYLODKSlERDH4T', 'DQVsKpY4etbmTaLh0Xi', 'IdLrTIY2BBmZCrtkxQw', 'CAMB2OYAq8vOsZNsFv7'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, eralHetPHtua1ICGjBl.cs High entropy of concatenated method names: 'b6tF58ymkV', 'TjyFmdYDWL', 'L32FIZu0ku', 'TNeFgAkfrO', 'OA2F6icXIy', 'Jia1dREwMbViQmCLGsM', 'QRIO6GEcxuw3oVtgrTe', 'HEZ9cbEJAiaGrTXX8ds', 'aXGIw8EzMtCfDxp40uj', 'kvvxUgCKaXyFmJm6cqU'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Fao0pFXauoKJhVnU24r.cs High entropy of concatenated method names: 'dKwQ5JeNud', 'ybqQmonXhf', 'N3AfEpZ7Kdc14ApcSlp', 'oPdRb5ZmLmqfdv43uAj', 'Htb1jNZTrdfsHTytNKw', 'AWwBZjZfnODINtiAxQ7', 'sxNggTZ6GEsI2efiYC9', 'jHVDduZU1ZGM9xxn2pp', 'pxlbmrZOWpb2TyKvT1u', 'Xbba8rZgY3dkQ1TRoEA'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, JTPsfWtQpEaAMX6DeAu.cs High entropy of concatenated method names: 'pNIRe184ns', 't0vR4RSPym', 's27RBnujXL', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'gA0RL6faOy'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, HBmGmJi7MKqXBAMmBh.cs High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'gaJyXC8GK7qpQg8O1kn', 'QUl3UB8ZUHcuZXvq61x', 'UOPISJ8VcO7pEEjqlwZ', 'vd1AoR8dODZW09hAm6r', 'UJ4JbX85X6VCqob5FJc', 'ykhUAQ89NXZbvK5TCeX'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, JoJMaR2q1qxJxXQWIQF.cs High entropy of concatenated method names: 'XDwqXvBbWP', 'TaCR0IlHMy2ljmclbXU', 'hWeOjTly0XG0GkbwrhQ', 'VBPaMWluPBxII2Nk6aW', 'g4RRHmljSxG8CI5ydgy', 'KVTyAMlvWOpRhmUOfc6', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, NRDZqxY6fWIZWP7reTY.cs High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, VcdkYsfI9tveGvcSeVg.cs High entropy of concatenated method names: '_5u9', 'f6mSEpRElb', 'GFt4ysOrJM', 'ikQSnCAPIx', 'my7x95mw5iVDIB2WTAB', 'XRTRhbmc71BPEHK6IUt', 'CTXTdlmJsPUlMvRYFQg', 'dM5MmOmpIejE7BagZd7', 'gbAVDDmQG8TvTARMUyJ', 'KEb1sNmz2gW9xTKf8gR'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Oi65md23VdKm2gsOdXa.cs High entropy of concatenated method names: 'uvLqJqaGSU', 'kINfEeaPEsUTDFkEW0R', 'HF6bpha1NfiDtHvLfCa', 'XAtN2fa3pENSLKR3RqU', 'sV1sYyar9wxw8BIHigy', 'Y2Lp5rak6SpjN1i2pkQ', 'Cq5wX8ab4mR5EeL12YH', 'b3AOxeaFWyUiLpQhBVj', 'iviSuhaeQFZXSVhfSU5', 'f28'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, cvZr45Duvu8imc9MHv.cs High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'xg7g2gtQ6JET0HdXxRf', 'ry7iKXtwZOPeRMyyN8H', 'FOhW6ntcC9ARromIjhd', 'SKmx3ftJh1YoTLhUsx7', 'yGAdhVtz3be3J4cFNJ3', 'HwxXG3WKUG9s4OlEcyT'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, ynkshMHGaDUKnFfiJOL.cs High entropy of concatenated method names: 'VOrwuSVt9S', 'O3MUcP19aH90kODDCqE', 'oLf5tA1d4hiECvVJwm1', 'RD4K6915dj0yTtC5yAM', 'OTGlgZ1sncUkk050twk', 'HFTkwm1iWAVFgBpw41A', 'yoawT2qeu4', 'cVfwAW5ZG1', 'WtUw5t6kQ2', 'qNKwm8og6m'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, NBcRiyfimHEJ4GSkLWZ.cs High entropy of concatenated method names: 'iRouiA7Hq3YdrtyV6KI', 'J46Kpe7yXHfVxfTs2So', 'efyRC97uou8mlZ0JWDe', 'FNqQ0k7jNI89F5c35YK', 'IWF', 'j72', 'g094k0A3WY', 'Cbn4jBKx0O', 'j4z', 'Pfv4T3eH7f'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, gQSinP71am3kqsuthu.cs High entropy of concatenated method names: 'jlkWNhwu2', 'vctuYgMl0', 'eD3FZw3X7', 'LasRgd0JF', 'QZRUNVnnd', 'PZeNbBvOy', 'Ln6JT2iFs', 'YMdxCJMaDOyyDDUruWA', 'UiQTdSMN4X85rOKRm69', 'O5a8F8MlXZo9Job50sr'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, a2jEEkfrDB4WP4rMyO2.cs High entropy of concatenated method names: 'oYo', '_1Z5', 'EdrSfLbFLm', 'zT54GTwOc5', 'R2hSuJvjju', 'l4YW6nT4GdtBlD9rIKk', 'a7Uc3eT2JWrm7xrquce', 'zjxR0LTAawy7taC9Uwp', 'pavPTuT37ijv5YObbau', 'bK5dUaTrVqVAwo01xBK'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, F3BTH6JOoGUR1eqLpP.cs High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'TgyOMP8XKUrXN54xRTU', 'Mwy0sc8p8N26P2NUWEt', 'zA45YF8QgjlRyQCZ0kj', 'iUGPPi8wrNMvfXGobju', 'hvFnrI8cZ9d2SkqVIbh', 'pT11q78JFWhmZovwdNj'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, E7EuKO2a12x1AttySy4.cs High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'DuOFkmIkEn11LGXrurV', 's5qhEmIbVO3CDO56i61', 'a6hFx1IFi2BFq8hvh9r', 'e3VZ47Ie9jdygddgykf', 'C2vsQSImQXaBeEmY3OL', 'foKob2ITEQyVxRqSuco'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, VvbaXqYn5pQkkDSRWUM.cs High entropy of concatenated method names: 'rkiLkav0hr', 'UjjYiJf1FSk1YQxovxo', 'l4djtHfk3Yki7cVSirk', 'KKMhDTfr1i5bX3s67oH', 'c7BLP3fPmBEwnG5KU2e', 'Hch4Q9DshA', 'cBC4PlWJxZ', 'v6o4Cyraan', 's2d4KpRutP', 'e9M42cskHr'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, FgaXpf2XXae79cHv933.cs High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'znJcccnpCLT6415rTIS', 'LU0bLCnQyZ7fDbVu5F5', 'JdrBMVnwURObLCCGhYT', 'WCJpNvncYQHXEOYig8m', 'gmE20enJ0bukiD1ToZp', 'IJmGCBnzNto0DDiYrYK'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, aGAwi5nRsvxKVSIyTL1.cs High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'e9Eu6BURZg', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, xt9Vjl8QMQpwM1EqLN.cs High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'TeEiSb3Ag', 'rcorhqYuNPXMGvFyClQ', 'WBCwDxYjBnbkNHDSYRZ', 'rI6WyqYHrp42P2TgbNY', 'wMckUwYymNKwXNu70Nm', 'GJWQwGYvJHZNbvo6tmS'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, CFAqGo22d7xt7Y8M2PF.cs High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'ldaFZDnkGetqlDr2rPb', 'IIufVwnbTdGbqsPMB3i', 'CJpf8knFCFvImhV9uSx', 'cdsIX2neYKaOAOTjasW', 'HtbOyQnmblRI5ONjIix', 'p8WqDtnTaDgxPVRYlrD'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, EPJHvIndFfJ1UEHqw8V.cs High entropy of concatenated method names: 'k5VWS7Md08', 'H54Wl7LRQv', 'LCZWOLqVmb', 'MS3WxMi3kK', 'I7BWH0i7Mr', 'eXGWXdSYEm', 'xvsOmGHdU71P81ajR5j', 'pRqWGhHZUF3hxTYUjHA', 'xraN6PHVA4ccVbM4eg4', 'zyGZG8H5yPtXJjyCXct'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, J3AXtZY4Y9kDNWR832L.cs High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'DQra1uhZbP', 'ERpanITCXj', 'r8j', 'LS1', '_55S'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, OS8OvfHvbpr6PiMJVb8.cs High entropy of concatenated method names: 'QmOMXhLyxm', 'eb4Md1H3PY', 'X6WiBq2kdFqi6p1iZgZ', 'u6MZI72bfs9qRqMPggC', 'frLKQq2FCUnGvOJCxix', 'dAApC22e8GTdYKFo3Zo', 'coM1Cs2mbp5Lyev94eJ', 'Et6xjf2T7WNSNyEpp7u', 'bFalga27bwEaD4Fs0P5', 'gI4GBN2f4PRFyG4hRei'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, cW3Y3EnKhM6SuvmyovB.cs High entropy of concatenated method names: 'UEHuGu2oFI', 'iTUuV7utcS', 'kvYu8IbgWH', 'unEuwmtwUp', 'SxFuEkcKCa', 'JHRueUG2TE', 'iRYu4eA8jM', 'XpWuBB04wN', 'jKquLB2EjU', 'ussubotnBG'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, aaaLqr2nT92mZBerO2M.cs High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'EcMTVNnZE1EQk0Ce6ed', 'ktJULZnVoOTucq5dpxt', 'BelExBndZAOsMrZBu9C', 'U0xNCjn5PRYbrE7IQBm', 'iguNS8n9n4IdCZ8Kc1r', 'i9skwgnsEdQOAESpcKZ'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, uq1PWVnNftTa4asjIlR.cs High entropy of concatenated method names: 'wx6WZySaj8', 'UXFWh4liCv', 'VUKWpCkHj1', 'qbHWsFnwlb', 'vbDWiKtM5c', 'iChU79HO6rAoUiFFMoX', 'alkCp7H6CGtLaAmVDos', 'phH3GNHU9jZqn14K1Tv', 'gU8LhFHg1kw7Cwxew86', 'ePVV57HxyXMD4yvpdCe'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, dV5nhg267Y3YKev3ZhT.cs High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'mJ3ZgnII4qoOjF8ExbD', 'QGX1yFIait3mdj1NaRQ', 'M464eQINmcp49c8Z1oN', 'nJqfXiIlRq1xJprqIIV', 'tXtS4uIqZkOE3behdkx', 'zMvKpQIRmfnhbJAMP4E'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, BDfwCct0e6rxD72tJVn.cs High entropy of concatenated method names: 'eqLurywHuM', 'jbNu0Qqff8', 'HFCutgLYtB', 'bdBucWMAap', 'Oyau9gb1SW', 'k55uogFoRI', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, p9BsUnYagYO97QgZ4Jh.cs High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, oNjeAJYJhPVEfCynnoP.cs High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, dYCI2bY1iOPg19UIsgZ.cs High entropy of concatenated method names: '_7zt', 'qM4bAHVBfM', 'z0tb5g8lEX', 'lDybmNwvv7', 'Co4bIPix82', 'bTDbgN7RSU', 'xsbb6C6yNT', 'AnTU706mIsVp0T9lcur', 'OoeFBZ6Tu1l1qa3uEuq', 'B7pV0R6FsDPQlet6coH'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, jtciwggrgHlUr4QiRL.cs High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'YPsxiJ8ADRRKLRsneqn', 'dE2CZA83A5R25NESand', 'fVEFr88rKYI86h23aoX', 'ABYK2N8PBCNScwsNSYF', 'bwCvEB81NtJdKRDj3HE', 'XisD2T8k7YBBUuxWVgy'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, KQLb7kfPJlQhLRj0bDX.cs High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'afcVdhm46aZiGN5FqAF', 'WH8TmPm2FirUb8WRbCT', 'TahaWPmAgsIVfIN7iE7', 'G6kriam3drXHZexNI2R'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, bERWuifwIMMInrGGWo0.cs High entropy of concatenated method names: 'WM1EKsBbgH', 'XMWE2nrdum', 'zcVEv5rd5X', 'JF4mTfF29vOguPIhLCb', 'wN2OfJFLCXxSttmynXU', 'd4v5ZnF45EwFrgqv02L', 'Dj5IgeFApm5CNXHmdWr', 'yD1E11XFDT', 'Ir1EnlhKlH', 'MdSEkGb5RA'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, mvigG4n6GGPQkvwx1B1.cs High entropy of concatenated method names: 'cnBW52LSuk', 'VrPWmLA0rM', 'tMLExNjXh5O5mvYUIXs', 'Off35mjprSFu8LZdfBV', 'hWP10FjQEyQpyMjxGC0', 'TRCj20jwDfJpwQoYnI7', 'NA6t0ZjcFBKdyPrfRV7', 'fwrntsjJmpPEdXaMfQn', 'Dhe78bjzoOGBdsSquCP', 'SQvPamHKvYPCgZGINJo'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, XVSfWlfoo0BQYIwBbBN.cs High entropy of concatenated method names: 'OEYEiqlal9', 'eJCE3EQZVQ', 'aUMErbGcQt', 'DJfE0vGPu5', 'mCfuL9FBQnQvqhmIT1h', 'Sr2OpeFuIhQjdjHJupg', 'cN2qsbFjAZPHwvX4ghq', 'p9O2b9F04brHfr0eYQg', 'fY2rhAFDDffip2lYV0N', 'EJxkXtFH9H5tKZY5IRi'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, xKKKsLHQArVV9O6dwsa.cs High entropy of concatenated method names: 'IUrGXrguOg', 'X81GdpoBte', 'Nt4Gz7GShK', 'FS5VyVkCOC', 'sdpVqt7hDI', 'EBRVfOS1ax', 'S3nVM8WEwQ', 'KdPVGvZ37x', 'PEmVVsfW8q', 'fIWBSE3pXVfC3W1nmtY'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, dvKP6X2l6wGx5LOBwyE.cs High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'yatw35IiurMMtZAFplP', 'cItkFdIX33Y2rg7jE8S', 'aAglLLIpdtG6NOq6dDW', 'o6XfjmIQlpMhy3ZJ43s', 'W4qGhEIw3FpyRrxJccE', 'xlY91DIc8EnLdknVlgB'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, zmDk3CflsjLre0EB5fw.cs High entropy of concatenated method names: 'LPsEcWILvd', 'nGHE9crkKu', 'AqXEo3es6x', 'pfyyrkFZOldKDoBOZmo', 'zQXl0oFVB7mR0F7pnww', 'OI0CtJFd2Xh9EpJ5iNV', 'DEV9jcF5T2LOQvNhpfr', 'kwV6NYF9Ta5TGEG6LHL', 'cpsaiiFsq1trm0pnai5', 'nHnwXCFiAgWX9PCrrLO'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, zUYrjbYv5QjHT13f4qn.cs High entropy of concatenated method names: 'jAabGwTjAg', 'Q4HbVHevLM', 'B9Gb82Qa0W', 'mL1HsQ6rVsojpKbdMyD', 'hbXsio6P5XEJtkdthIK', 'qcYDdf6AURpqRZCbaKw', 'bmneuL638f2vZjZ4Xi9', 'uHmGlN61XCBmH9B0BBw', 'k2pNT36k1efT9sjLsWl', 's77AiQ6bmSuD8vVYNMD'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, wB2eiPHDvDUSvA8atUD.cs High entropy of concatenated method names: 'fWW8EsWFa9', 'oR78ec5DuH', 'nWhSovPpXoPmJ12DtC7', 'PQDBvoPQio64EUb3LTW', 'RZSHHSPii6l1hvXcmDU', 'ij85fHPXgTQPwtfJX8N', 'QB58kBvdQT', 'v0INgN1Kl5OBmtTHi2e', 'yRDXhy1M1PMB94kBl0B', 'JsJ3oPPJUDgLDWDYnmd'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, fNIrkv2ixeoQbPSev9W.cs High entropy of concatenated method names: 'g5pfAeQpQp', 'rfLCQQRnmgwnUgat6Lm', 'Y821bDRI5AV340C1Hg8', 'AVhUu5RWnyJiGC0vdxK', 'H8CHKaR8XS87iHyCO9j', 'ODUFPuRajCjYoRSHljO', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, cONEsitFE6J213R7R97.cs High entropy of concatenated method names: 'YcBNYd0rnG', 'M6O6ghoxO9ht9KPmXyd', 'XADa7bohqt53rTUSitA', 'pkyduAoOSynO0xeHP8k', 'EuN2G3ogbiYW9LuVIYD', '_1fi', 'OHEUoFIoux', '_676', 'IG9', 'mdP'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, mvoIo9Ho2tEWuYV8x4Y.cs High entropy of concatenated method names: 'NYTMx30bpH', 'wQPlAk2t3wGi9PABmXX', 'nCZmSY2W4824b7O89aZ', 'TrXiLJ2MxLjpCkF2ihI', 'xGqJJD2YYNsaBxLg1mI', 'NpeycU28L1JTOH2OuWr', 'PghNvR2ntwY7vaVSEjF', 'KqlAyY2IthkayPAL2F7', 'gjWSfT2ahoUMCF3r18O', 'mJ1GbF2NmOhRwlgP1MD'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, khPaFg29t0NcowrfCYi.cs High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'n8KrPIaVVE9Rsfytdnd', 'Pf8BbaadZKri5Fpu0bK', 'cNSL4ma50s9G6Z3oAAG', 'lrlUfVa91ZhEI1wKcDb', 'CWkGbAascAMFJoNSyOm', 'YlDlFMaitfCW8IIK3Kf'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, CFEP4nnCZVdQRDBExsB.cs High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, IcR4PoqJoCLicUPMFK.cs High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'zSKQPRtjFnNw6fguOye', 'zPuwZQtHepmogdn23IH', 'lxgqhbtygNwe8gv813y', 'DHfHaGtvkQJZGsJ1nLj', 'ic4yAPtE3iGRgJevpkN', 'JnDm1EtCkF0VaBhQhVc'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, G18cvjYsPIhZKg9tSsC.cs High entropy of concatenated method names: 'ROpbKeIEht', 'bAHb2PhNCM', 'GpYbvIo4XB', 'mr0b7nS9it', 'N8hbYlui5a', 'IZ90AV6u8v20GUgS5SH', 'w5qPFY6jrIo8FubtgAk', 'hRrcEx6DJge3LsIlOgX', 'brYmj06BgUKfApwr8ku', 'ioYR306H9IMmHjZRQKq'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, gPGcMO2gAx7FVc3Iccg.cs High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'Qb4vIbq018xTxERfhhs', 'QAsA98qDfe5Tm4hHBrC', 'KHEcXmqBFEwLDcBSCp6', 'GXJerPqu8VEjNeaSvjA', 'X9dbsWqjBWLlm0VOTOH', 'd6EWRmqHwc7JDdkKDK2'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, NfM03DX0npGwIBhROl.cs High entropy of concatenated method names: 'TNlDbcPNg', 'gVhXKPDEOMjEIPUpE3', 'FSYpIdhYIKo9xsRGlr', 'HCmyCZ0QOdmDJZQU7i', 'iYPnd1BT6trl0TYXhL', 'u5XlI4uT6kkoMCFGjK', 'f48fvXm0B', 'hq4M7eMYR', 'R4DGhW3KB', 'PmiVKMjug'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, NDndyI2UGErCG9lN0dN.cs High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'tlhrwnqF1TC8qAa8VZs', 'arbnPdqeDiqHBU3P15S', 'nsftC4qmYW3YGPJ1PwM', 'rA9JbtqTP80CTqW3EXy', 'MsNDwGq719s2ZAQ7Erj', 'vFf2YuqfCNX1e3frYYr'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, luiIaYrihW6QvBxS2K.cs High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'l3FDeMWomkdZ2lV8Mdd', 'da8wLvWGnbIA34aTvVI', 'mGnTW3WZ9Qku9iY6ptn', 'nfKLR9WVjdR214KvHXw', 'uJyrDnWddX9bLUnS7L2', 'qaGZuGW5DWJZIMDrqpI'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, S69INZtHSn6xNdkX6eF.cs High entropy of concatenated method names: 'P6VFEXLWrv', 'EjiFeScZSd', '_8r1', 'FXsF4EnRFL', 'FIwFBIePkT', 'aQmFLb2iNM', 'mgRFbf3jsi', 'CfSSlDE3ejfCApwqaGs', 'ut8N1PErsuKs7YlvUhu', 'Q1efUrEPd2sloGCAajA'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Mx6vSa2ogEGV8VWKrcN.cs High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'bbZc5ZIvyArm2yK6eOQ', 'aubqXaIEsGidEMUujCQ', 'bdi9FjICRWPr9KMXqoM', 'lLdK9RIS0tgMgM0QueF', 'W8AYsKIokBHyNHdOv8R', 'zAYesyIG4IXAyTc0vxE'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, knZiF92uiMYVJHIltG4.cs High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'ubX7kmaKRT2sol4A2By', 'nwNGjNaMeFdehi9yyJK', 'jyXx0eaYylKkR4y8frO', 'rM2WO9atlA9olGHeOQt', 'h5mqPlaWNpF88ESIqJ4', 'GLTy7La8d7Y4o1bHYTT'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, VpnlnJI4Ex2OvOMeG2.cs High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'OB7IFcWPwvONZrV79es', 'kDOWhNW1hhHWM3o6ZnG', 'sim4tBWkcvMbE1b6jEf', 'dh5nyuWbUkECN96tfOB', 'KmtXgQWFegrQBoVTNMv', 'kTZnnuWeoiYE7syNFDy'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, dQvlNK2POoSwg4haRpo.cs High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'SYW9FSa7iS7VThqp0xa', 'Ir5aKXafj7LnSndksdr', 'i2nsYRa6sXG4DHFFMCK', 'EJ9U4OaUIJDeqChL13w', 'TrT2Y1aOeYZQx00cN1L', 'z1EZmLagG4LYAKF1LbI'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, eErudoLKiUsDKeuZ8N.cs High entropy of concatenated method names: 'UNh2JgVHh', 'OouvLrXxC', 'XyN76ph4U', 'FhohrsMycy0SpIvU1hy', 'fZ378YMjZ4VCUl6898G', 'hUI9sUMHYXK1wDM4CXN', 'sMlwtiMvcZJTGtHwMHi', 'bXKIGfMEH0cPps0s4aM', 'nbY8sjMCvoGFgVjixKh', 'HwYUuGMSOAEHpr3UihF'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, h1d0uX2VntjH00iAbGU.cs High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'Wu39n8IU0RiBBL95Tm0', 'DVR64VIOLLsaPrSCqDb', 'PJJL42IgRkVudjUO8Jh', 'etPBT4Ixhdg4RC2vRfb', 'J1qrHZIhAyrBVRh95lu', 'lJN7keI0JKvXwknGjS9'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, quC7xUfgOLo8MSf770w.cs High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'Dx34B9a33G', 'HZNSMTxAU0', 'hIg4Lk2rpl', 's2MSw2Gwcs', 'bgrXhZTySFuhqfCWjE2', 'esZaBrTvtEdyhe8sQVT', 'NvRoPQTjTdBYKPn9Odj'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, VDJubHfWFSlxx2NCZUc.cs High entropy of concatenated method names: 'AOIeCWvsZ6', 'gOHeKS1uQK', 'Ty8ojYm1w5d1CyibHVT', 'k7uO3HmkwVDIAAhsRIu', 'VS7G6QmrEFVn1CD3YDc', 'qnO6kTmPKeZ8bncFo7V', 't9LcElmbbHpr4QUt8Ah', 'XoP3hUmFROlqanHkO7C'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, LDWFyVt4ljbby3oMGgA.cs High entropy of concatenated method names: 'rxqJgWELYP', '_1kO', '_9v4', '_294', 'VZMJ6iKLPB', 'euj', 'rXYJWRejUl', 'QMhJup5VXF', 'o87', 'MXgJF9ReHn'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, MMpiQTHbhBXb44plkcK.cs High entropy of concatenated method names: 'aVYGDKxPIm', 'tGNGaO72fp', 'lMnTyIA7lo8sisyXNnZ', 'QyGBiXAfNHoYb4LbIC6', 'zUYKYNAmVldWwXwljlU', 'oaSDA9ATBiABfVbsITf', 'Mle9I7A6Xxrlqhi459I', 'Vy5QGvAUUHJtf44cZVh', 'K2MAHDAOcXa1bUwtwMs', 'NNApcqAgVBOr0gxQTmq'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, MCCVu7H7bilPFDLGZh4.cs High entropy of concatenated method names: 'sAgGmsSsnH', 'mYxGIpEc50', 'uetGgqTHMs', 'zfvG6lvjtb', 'qw1GWVV9C2', 'WSBZeE3KRmVXbs9CEn2', 'qqT04y3MkqQfkWqZtOC', 'VeduJmAJje1kOmDLZde', 'MMeenGAzQTpP8093h7r', 'm8Qp9c3Ys0mOQhCI4Vs'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, URh0042ppgdA5iMg9BT.cs High entropy of concatenated method names: 'dYXqrvmafp', 'uOKcDslY5mNNFtbYrar', 'eYsRBJltuL74FRYPyAB', 'JmqVXvlKxeqlknFDd5f', 'N8d2uglMKqfNfV9JDyT', 'X4bOAylWffmtZa4puuu', 'l7WxiUl8Cv4dDn9aele', 'ccNwtTlnbPGLlkdM59v', 'De2qtalXBP', 'Jxx9wqlNOmR6B34Dxvy'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, KU4EFYfz1Z9iqC3UtcD.cs High entropy of concatenated method names: 'Bs34UN1Dqm', 'Rfw4NZIWwV', 'xDQ4Jg8EG3', 'ArfloL7Cujt4c6pBaYP', 'mNtl8e7S2TGHsWQmVgW', 'VdxsSE7vq21LA5SBY8n', 'QfUHWF7EHDMYH5SyxHk', 'CLIX6o7oCxuOGkGVxxH', 'BEbgT57GhdPnX0HDnMj', 'wD9hs67ZDs5mGiI48dm'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, x49eL05NWaO3S1ThX3.cs High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'l0DA7P8OitclKRqohMu', 'iKnaYT8gEoyyfetPcRj', 'o22hqS8xMxxYMAGZXNB', 'G73Vgs8hxV2rxWLPeag', 'dTO7Qo80CDrC4oa23kN', 'C1fccS8DtA90XuX2cxL'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, rEbNNa2rosaZ3rkOGgV.cs High entropy of concatenated method names: 'kVTfBhDr3K', 'v9EfLrXLkK', 'hleeavqRbxZ1A6gQ8oe', 'AYVTYZqll1MKfcXAj74', 'kCQoe7qqAw7Fs7H3gG0', 'plXMkZqLaDwxjF3SVOd', 'j4A5uSq4RFok2IteyU6', 'z35vTwq2wFnbr0rKUUh', 'AvfLkUqA0bKJOd3e7B9', 'AdQhuEq32OSkwVsAqmS'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, wT8t5EfYZ9RNODF4Er0.cs High entropy of concatenated method names: 'QpKws7nlLF', 'Jm8wiYioBR', 'Mf1w3KLDjR', 'VjJwr6kor0', 'IbKw0k4v0u', 'Xhnwtp6Ik6', 'KkXo1XkgloF00nZ49iS', 'KWk8TgkUUoEMY2f3Mul', 'HdxdIQkOLs74nTMZ08m', 'bWthsNkx8KWIh5q8dSB'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, lvxru9XSYHmfybYDoQZ.cs High entropy of concatenated method names: 'pNGPCesAiA', 'EC9PKLCxRu', 'qeVP2iIPF3', 'tbCPvociJ7', 'OvOP7AV3NT', 'yYePYOcyJD', 'nhmPZZVOcl', 'oImPhaTZyZ', 'uJTPp26SYn', 'kanPs4NU7h'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, bFgWDvHHF4lHUqiHEcs.cs High entropy of concatenated method names: 'EmNftWjn2r', 'LDqfcJIkqo', 'Wu6f9x3sbG', 'GQtfoxarEa', 'q47fSD82qp', 'CclflsZJX1', 'SORNRXLP6TBK2kUkMoe', 'D8C6qsL1b6wyDLEf63W', 'K5wVNvL3qJaYBamlyAM', 'Bfi3umLrJIiJZOwjUxw'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, ViwSJczHrVXyVcxQNg.cs High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'co1nk1ntb0BpOTLUTX2', 'fcYwllnWxgUlMuP4ZIq', 'gDQZykn8n1rL7N7kST2', 'P8HpVonnCIkJiNH9jRg', 'TjwyngnI10sgjKH3MkL', 'I9yLJOnaAv1vyxPxJPg'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, yxJnlCnBxDVLPLJc3gA.cs High entropy of concatenated method names: 'bovvYby8iYe97FZph9E', 'cvyVP1ynF7CbA0hmVhT', 'v7L8IhyttJBXc5qy1bl', 'BWK6Y4yWCSjs6kws1BF', 'cBwhSryI2lbGRAKXDu5', 'siNZQEya7xc0hQOCOf2', 'Co3lB6yN9fjNISZGwbL'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, TUUfg0H6jLVt9OAyhrf.cs High entropy of concatenated method names: 'HDlMCtkhtM', 'LQNMKsOL3N', 'HpAM20ktpo', 'tG8Mvyi5s9', 'mxDM7WQ1J9', 'jH2MY6LBoL', 'KEyMZxGbwr', 'flY7kJ47Rc6cKQN8N4I', 'bg2D494mWccramX1WgK', 'lud0n64TUg9yUr6RrpP'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Q1Q9qcUUN5GdH1kJ4V.cs High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'C3Ql9T8nT5BGRBPVQDt', 'kJ92pC8IbVR6KFMguSL', 'ENEjP98aAPxs2NmkCQx', 'w8u4fQ8NeSnkn8ikEPL', 'MkyKOI8lrXqpnIvc2XJ', 'I2RlyO8qYyNiy9yfxtq'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Kc6f4ufumZWiE26nCKN.cs High entropy of concatenated method names: 'M5BESBQeLS', 'HVHElkTEjn', 'ScbEOhe8x6', 'J0FExJ1gHv', 'vVnEHKLaq9', 'RB388henlAkYucTUjgZ', 'XvsVfUeIENQ3KUVW4jU', 'CRSl8veWf3G9wHPEmZm', 'QBGcDIe8JhfQsgNUbeH', 'Roit1gea0h4BwjH8e8H'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, b28LcQXlWL29YdhBc3I.cs High entropy of concatenated method names: 'nIdYVwZ5D3Ooowayjn2', 'y4YvvMZ9wQjNP65FBdb', 'X122kwZVPymnrB1qM0b', 'AFABNjZdm6TSo8eQfoj', 'VSxPIsVdXr', 'CSIHDSZXNMVp6UJRq1C', 'rUXmrWZpkgupcbSaycO', 'cQeGKaZQJ3Ol1hIwqm2', 'hEKyVoZw6I5uyhbbtdU', 'T5LvuRZcvoibJwPbUkn'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, UmeiCsfMPAOlxMZO3cb.cs High entropy of concatenated method names: 'sg9', 'qqJS8AXHNY', 'K8IeXJowxf', 'PdnS5Mt83R', 'FRYGeBmdWDwaQXoOdDs', 'QA2TWUm5FVoKh6eLTPc', 'O16g36m9NrW9YIYdIck', 'n1y8FAmZVpJJUdHGGOg', 'GsW1kKmVObFIBeB6AJl', 'WAIgvTmsltM76RPZl5L'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, UMn8mT2ErL7Bv2yblRk.cs High entropy of concatenated method names: 'deHql3ksZT', 'hGaH67l7gEAXCvYLExM', 'x3gJYTlfiPxpWQLKoV8', 'JRtUQMlmdAL3uJebbTc', 'Cj6wvTlT6wQioObnYB0', 'Do2V9vl6kMQGiMILZfD', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, FXLOnaXe5tGLs0pXtLv.cs High entropy of concatenated method names: 'iaWUwDee28lDa', 'QZ7fbBZuURMwBL5OL9h', 'HANVuBZjTPXlC91lrX9', 'jFRRsuZHZEvO8K9qld3', 'od8HqqZydNAy6IEqheR', 'BYZPgAZvNuMpPADGCqp', 'obM26YZD5N0DJVl9H72', 'ewsOiXZB5WNO0HDOSM8', 'gerJ7dZEME2eFFuicGc', 'HXSLLVZCD8VNfJDGEpb'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, Fq8SX1Y5Q0gZc3KsXU0.cs High entropy of concatenated method names: 'TxXaXfbmGK', 'zWpa2U9wfZ', 'IJDavuBxoM', 'nkOa79hXRt', 'tPMaYmZIwl', 'Qj4aZageCP', 'SejahIkl4F', 'xxZapruTtj', 'bY9asutTsF', 'CaSaimObx6'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, znbmhi2N5l9vFUrsooT.cs High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'uZo7V1aJ6e5Hb6VlRwM', 'abn28SazIICdeQbflLo', 'VBgQW3NKIwqdjqouubV', 'UrqiCFNMHv3Fb7JHqnu', 'oS4AXqNYcNJBxflGnc8', 'PgN6eGNtYlYXmkB9sFf'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, rwPYK92f5KgyQHEEiBt.cs High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'B3cclanxNvojWJhmH0W', 'rMiknYnhVsCpcqqGEuM', 'HWsL8Hn0o2wI6LmdwXt', 'esfl0rnDU65rLJ9xAIS', 'R3kmmFnB4n2FWATpjBx', 'HcqgZ8nujw1O4AgpqJY'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, LxxGoRtITNhbe6jlBUq.cs High entropy of concatenated method names: 'PJ1', 'jo3', 'UW1JeEncHI', 'USrJ4fA2Gg', 'FEmJBxViWw', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, h3G8NvMLOQ3rqVdQMo.cs High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'UkAbhyWq4jgkcepAWkn', 'SIRJwLWRl4GW0yWWb6c', 'lgCmTSWLdhraUosytxd', 'A2HFAJW4iDJCmY9FLEv', 'pdtK7QW2pHfvxpksMB9', 'vv6OlDWA6bMo7Ml4pwI'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, ssYtKNYibVAFYO6hawI.cs High entropy of concatenated method names: 'nhV1u7I8Ag', 'OwS1Rdv0J7', 'Okq1DH3MeM', 'BcC1aVy2Qe', 'bBw11ATvSY', 'koW1nAEBNB', 'sKj1k2DU9C', 'kEM1jJj27g', 'Ddr1Tu5NId', 'KdM1At73hy'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, F13bmCnpTR1Zdv72Ufq.cs High entropy of concatenated method names: 'NVBWtICNQl', 'TGoWcd7g38', 'EHUW9fFfTV', 'vwacWUHEWneuk6aeN2l', 'cD3M3nHyX2s5X39DqFj', 'pk26WRHvoFBhMCJ2N2Q', 'v0Yx24HC2xlOmc0lcDB', 'T47b12HSiQpmrdCwS6e', 'Wx8IOxHoO15NIpbJHWL', 'hgTurLHGHenhaEOB5ww'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, h2QUdbtt93dPfZnFNLb.cs High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, kg3eUEyh2PoNjZFl06.cs High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'n9HeRpYcMU035uNb6Lq', 'XBIX2OYJVwLb1RNIpt0', 'fCOoHMYzOv47ifoWm1E', 'FMIud8tK2MF3tp94Hqv', 'zXosAStMcuHWod7awKT', 'gxl0TMtYYIehoshRVhi'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, QWwYdPfV0VnBNFFqJlK.cs High entropy of concatenated method names: '_223', 'ueEaVgFPIj1yb5wuhVN', 'kUg9ADF1iLukP8hUeoj', 'OGXbKlFkTkC1HCrtrOD', 'WaJcgUFbeIognvxMYDh', 'fAEVVlFF9Yopmt56C2B', 'g3eA25FelPsybb7c0J4', 'db3Jt7Fm0BFMWILNRwe', 'tGi4u7FTRnOEqbO77A3', 'L2GsDQF7wHMGPlklMEA'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, OWPJ6G2AqRg2xPrHCE3.cs High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'vItfndauHMuErVbUkop', 'hU1PA8ajETcnCL9OoOC', 'dyBrx7aHoLD7KPqX84g', 'RUDxPUayupTKxybxDs3', 'gNLpvSavDaamK0ubGT7', 'eweLOmaETdmEFGFrTo8'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, JHZsQ0f2hPd97IkOR0A.cs High entropy of concatenated method names: 'O7VwJKCYN0', 'y5AwQ8eJPE', 'rBlwP5uPhh', 'p7AwC3a6hm', 'ANmbD51zD4ggq6GFjFe', 'ntyqFP1c4jCJ6po9lm4', 'bBKdyj1JxXAu6QpSh2l', 'xYhnAdkKSHphdTYk1fX', 'dAgfb0kMWjyK6nrSJ45', 'IvhJHZkYlFsAUEUV6fU'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, K2nSjTf3v80hCQ8USL2.cs High entropy of concatenated method names: 'QdXe1nAqa4', 'lNDen0FRIH', 'OX3ektki0Z', 'IcmWnFeoOS9GGQ6FWnJ', 'rMtXnWeCbqBq3YeSQlP', 'WW9WlXeS0u9scjlbOKr', 'PhlI9VeGktl4FWsPtt8', 'hwIe8hhFJq', 'q1IewqVXjD', 'e1qeE7umK2'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, dVDfJHYWRWJAZNa0ei2.cs High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'IbZDySXkSt', '_3il', 'DyfDqN1Csk', 'HO3DfiC4jU', '_78N', 'z3K'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, rU8DGtt8LOjBhZI80gm.cs High entropy of concatenated method names: 'EbBbX0oW2SachgGNkQb', 'XwCENgo8GnnyQJKa9Ow', 'WsPgLUoYXaTgIq1IAMQ', 'DkcQAKotX1JApqL3CwL', 'SWrR2Ia3AX', 'WM4', '_499', 'w3MRvjKCv9', 'dH1R7n1b2e', 'duIRYaD8Rq'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, IvaO7T2Qifh2UyZOUDS.cs High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'ugwh7iNjwJrSn0QMChT', 'GtATy8NHWUbqWt46q1f', 'RZTWwnNyvysf8BYSpen', 'HaMlydNvFcZD9lHNU6O', 'uHP6KnNEdTr5C9GJmxW', 'BryHbmNCFvGaPCouiLX'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, NJDr5DYNBKMC1Q23jKN.cs High entropy of concatenated method names: 'mbsDKgZBTx', 'tiED2FeDOO', 'lt8DvoCLQl', 'E7hD7gN8tX', 'qCiDYEVvRQ', 'rivQICUk2E0p6SJAHdm', 'o7gW3GUPnb31fl3aIXC', 'DTx0sBU19L7Pyq4nM81', 'XnAkNJUbopYUfxR7Q38', 'jSXxtpUFc8ZH8hCSjLo'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, KhvwZpH1voaFaRemOI7.cs High entropy of concatenated method names: 'srlMz2Oy0i', 'OoeGyASNtt', 'qqnGqrp69Y', 'IeBGfrHaD1', 'BJDGMHJoRn', 'MWEGG9V5QZ', 'xRbGV9F2mL', 'McuG84KYla', 'rl1GwUGs5t', 'nNtGE5Yi5f'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, CLaZrEtjWo1ta29pEY9.cs High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'mYvRuDTXFu', 'MiZRFFVc3R', 'kPVRRTHn2k', 'ipBRURvKmQ', 'HH0RNKcCWO', 'qQaRJfNY2t', 'GljTfXSHNyMWUurR2lC'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, gcmTyj3QBltYkNEkyy.cs High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, a7FkGr2G58wCJ2bx8Ao.cs High entropy of concatenated method names: 'CkBfgjAgRM', 'yXNf6S6uMO', 'iX6fW2D9ir', 'YX1jpFRqQsbpmslkewY', 'bVwu0pRNufQexhZX6Cr', 'OX5w7ARlTf9gcBUmarf', 'eDDjp2RRqAvRNNm1QpU', 'TkWIWFRLQqOqjdpxjOi', 'VpZcX2R4b1HSKaOMQau', 'Ut9m89R2oSiK9PhIMKY'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, HIVMdFnGTlLOersS2YB.cs High entropy of concatenated method names: 'UGauUTTUHx', 'D9ouNhDZwp', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'y6IuJyqQbY', '_5f9', 'A6Y'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, EBf87KH0kQNjngNyJMG.cs High entropy of concatenated method names: 'V0Xfu2U6r9', 'SUhfFCbq8m', 'uCCfRx7TjK', 'aASwaeRDfICuFJNfyx4', 'rLbHGsRBiVSyZZsrBo0', 'WypQy9RutFTru4tRimD', 'mBPpSwRjSC1MDiqVBPA', 'RuuKLtRHbH4EiCaqT1l', 'uhk9OgRyhwHeGOY7d5N', 'xC8VvpRhOao6CVaVxm6'
Source: 0.3.iwtYgAXvKB.exe.77f73aa.1.raw.unpack, YCfB8yfUPnaOBb4rNGU.cs High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'pcoSvQMNOw', '_168', 'kMWiuHTfAieirQ1JPfQ', 'J74b2eT6QOqSSCi0Zi3', 'jcaBFyTUF83l8mhAOwh', 'M2P8FSTOTh793JWSkVq', 'g3c0QRTg1xT5iBonOpO'

Persistence and Installation Behavior
barindex
Creates processes via WMI
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\containerprovider\bridgeComponentreview.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files with benign system names
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Recovery\smss.exe Jump to dropped file
Drops PE files
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files (x86)\MhsFZJQzCIAWwGKKZKgtHJpnVmmJDKNszUpodVapiywc\conhost.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Recovery\winlogon.exe Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe File created: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\Links\sppsvc.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\LhMoEdVbIY.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files\Windows Mail\LhMoEdVbIY.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\LhMoEdVbIY.exe Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe File created: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Program Files (x86)\Common Files\Services\LhMoEdVbIY.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Recovery\smss.exe Jump to dropped file
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\LhMoEdVbIY.exe Jump to dropped file
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe File created: C:\containerprovider\bridgeComponentreview.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\LhMoEdVbIY.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\LhMoEdVbIY.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\containerprovider\bridgeComponentreview.exe File created: C:\Users\user\LhMoEdVbIY.exe Jump to dropped file
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: bridgeComponentreview.exe PID: 2504, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\containerprovider\bridgeComponentreview.exe Memory allocated: 870000 memory reserve | memory write watch Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Memory allocated: 1A480000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Memory allocated: F00000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Memory allocated: 1AC30000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Memory allocated: 910000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Memory allocated: 1A400000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\containerprovider\bridgeComponentreview.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\containerprovider\bridgeComponentreview.exe Window / User API: threadDelayed 1005 Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Window / User API: threadDelayed 1052 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Window / User API: threadDelayed 354 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Window / User API: threadDelayed 357 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\containerprovider\bridgeComponentreview.exe TID: 380 Thread sleep count: 1005 > 30 Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe TID: 4788 Thread sleep count: 1052 > 30 Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe TID: 2640 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe TID: 2260 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 9192 Thread sleep count: 354 > 30 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 7740 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 6968 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 8544 Thread sleep count: 357 > 30 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 9184 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe TID: 4764 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\containerprovider\bridgeComponentreview.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AA5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_007AA5F4
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BB8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_007BB8E0
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007CAAA8 FindFirstFileExA, 0_2_007CAAA8
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BDD72 VirtualQuery,GetSystemInfo, 0_2_007BDD72
Source: C:\containerprovider\bridgeComponentreview.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: LhMoEdVbIY.exe, 0000001A.00000002.2355427591.000000001257D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 0EgfcYAvy6nq5BtpbepMyFev5igvyLkwRXluEk9O1vSlyk9vyOTQydR0HDuJukJswhhvy5pYyTlOdGq3jU0lFwEvyIoWV3JXxUFtTIhJdedvyAJNvWdd0CiF4jPcDIVLAMblGVDAWWEnNo6KDUAlS7mUCoDD08AtcRU9DkXbypsfttDPhbheubMBDZmIssQHRiDQLMImVw0pD2j8iUqlXgDMNv0jOYNHDo7LQPEldsDwvBSnkQQlDBlgmAHma3Dhqnxw5JWyDmC4p58d0bDaGpHD5PRMDyH6QctfRBDrnmhyLw9UDYLmsaNkGMDNdGnbQeEEDEC7qHotA1D0NaJo4HFsDz3RTyecZJkuGvIUHUYrkvwIk92BAXkbI8Dq2z1okJy9wyIsJ2k7DNegmrMwkRQ1AuahenkGGsTxtQkwksmrBxGQsUkxUBBboGVTkTAFOWQFP4kCmrIIFFgxkFrAUVSkJhkistPwIzO9kVlnRhsqeJkjekyb3dIFkfqdTcGcRmkHLEj23iAhkXrILrpxXrk9G83q5UXTkdk3gbkLrZk4vU9agA6ck8SdY2tBivkcE65DvUnGkggLaATreqk3Wi6pnp4GkWHFVMYoklkeV6rhojAikSV9yL2e6Nkna7hKMcbPkKpvQyDtM0kqfTOYpHAMktBWFLdshdkpGOKrTm8jklmEaS3GHLk1lZbgBemdk6sgtg1tntkLb8rAXdlUkOOH0qDJMhk5EHnhvcyykIkIbFkYs4kApXG1oTEvkUVIFwOCCYkDZLrvTxBykk8jfO8OQakPhC6VgYMMkZmShnyABlkQWNPSNDK7k2SOXP2zXekMhZo6MJ0SkoDfl2wbwwkwWtEfvemikBoKXlvbZnkhbHQ3IPVykmc8viEDNuka42qAOwPGkyuZcbywH1kr4USaVJnekY2VcUQMt6kN80jvMTnVkEuahyawovk01K9Uwe9GkzHXdofgdPPuJlq3XByTPvEOMdbMDDPbOxKq1y5vPJh9RBxz0NP7idWJZeWuPRFAmxLNA8PGOmeKMaWfPsUKqu3nFePxOcqRZQMnPTkZOewD4YPCiKeqvfpXPFPBsB8F5DPi4eAZ0HJFPV6fLqhRQLPjvxmPYcxOPfc98dWIP9PHWILVjdcTPXRGGkaKWaP9Up5EtIEkPdRIDivCgTP4JaQ1fsU8P8g5GuuBsaPcC50MEf9MPgwmvncvchP3sQf6FRPwPWkn0JMuCaPeJPHNWY7dPSS7fO6ejmPn9QC4QgG0PK8dJc9O0dPqHYwo7ygKPtRU2NMMqIPpmRwFlxUZPlpllNHtveP1LBu0svfVP68sXpIfoPPLTO8i3KBQPOyaoovYcDP56y29YupxPI08Dv8VoaPA66mI1Pq9PUL6igLiX3PDIdV30ntKPkLScy5pQiPP6ShxsCOVPZE3eMbX7sPQKK25LhCVP20LP3cAfMPMXZRVZcKZPoMPSsuB6lPwy8U9piMDPBhpCQlFcgPhERdU8FY3Pm5nhoHAkpPa8MXxKTPWPyD1yMjUsWPrljNW1MlIPYwK8mru2PPNURKlCQSXPEwtyKXxWwP0FkCanF8wPzWZ1S0aL4ZudhfOYgr9ZvxUoy9jPdZbeYKVmOcxZJFvjjiWTbZ7raK7UcByZRZpQ2VzBZZGne3JcXL7ZsbG1CJPKpZxX7JqGbc5ZTkWGPDMMdZCvPdalyH3ZFgnDvMtSIZiPU59VvsvZVkl8YFgSnZj6y4nsA5qZfIW7AglG8ZHw3Exmvc0ZXMFNTPY8mZ9j4CRMnXrZdVQPcIkZtZ4HwBDqEMuZ8YXyOepoKZcDN4Vjj8yZgnyHsAnI8Z3YhsutRaZZWn3EeKmPMZemFcVNIE4ZSTt9JdHVMZnUsLklWLgZKwMspMo9oZqbD98NvdBZtGf77EytjZpMLinsNciZl22Lf3O1bZ1x4HEfnTiZ6ccqpqaxAZLe02xRp7hZOXg1jUrepZ5OmwrWQOAZI3CpW6LriZAOEvnAq67ZUnMx3Db7VZDweTmIbwAZkrS1rOywtZPG1HObMKAZZnNY6prj1ZQGb9ojwsjZ2xfwqateAZMu6ebhNb4Zodir9YLvJZwqpX9Gq1qZBaFjPpeH1ZhAkqSZaPiZmDag2iyxRZaZQRr0w0tZyLlo2SwGIZrV5p3SKjZZYEMQm5IE7ZNc9lOSeQ7ZEdcOTuLC7Z0n9KyaCldZzCHYnteYcQu3mlLuF3oQvXbrjlc4RQbS4pJlQ2KQJcDRUsfhtQ7ykDr3lN8QRWGZyPeiLQGAoWvKc55Qsgp3rwGusQx1gNJvAEQQTZuZNvNWcQC3UCOnVFuQFuSQ21yceQi2mtwDau6QVpMxaCic0Qjo9RxMqauQf3JemtcT1QHy9EeZHpDQX9ImShPXFQ9mPjRVS3MQdo4OcdLnPQ4ya5pyBgBQ8tj68mf2gQcEofYfPHBQgFHZdlC98Q3v7lWeyhDQWCLwfMPIuQe4fbwwcRrQSmKtooPhuQniudcyEuVQKItpgxpsIQqZaCtZLSyQtpFjtAuGGQparm7nDHjQlPf0qWIXMQ1RSMwjTbxQ6gWwB5rw2QLpjq5vAa9QOhpbcuenfQ5s9XxafqTQIXtXkcYoHQAEnnCxrfjQUmS7RnX9EQDrRdDJqRVQkepjVwSKZQPGL18niQ3QZFyUayCSlQQmLvSEzQXQ2PcnUAQqlQMAnCSedblQoQ32kKxJ6Qw4cg9mPSJQBsnLKpXWHQhnwS5bSrHQma1PfwlyyQa7QR7VK9UQyO78JbgtxQrjkNtqMr7QYQXFcVlWSQNMKywGOfFQENIW5FgBMQ0aScVmTbIQzFVUyMLU02ukVaLyRgN2vWCnXUm322bl9QW2ry92Jog9tvOG127AcC0YgCv2RmUWo5ugO2G1UW8DPxK2seQ4jHS5a2xB5sKGLgA2T1XjWtPt42CQ28YsBIF2FDFhagp4g2ipwePyggD2VmJOHiy632jS9lO6XWL2fd4dYezxn2HtFAt
Source: wscript.exe, 00000001.00000003.2070531126.0000000002DCB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: bridgeComponentreview.exe, 00000005.00000002.2185163681.000000001BE9B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\F
Source: wscript.exe, 00000001.00000003.2070531126.0000000002DCB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: LhMoEdVbIY.exe, 00000018.00000002.2338588791.0000000000E66000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll+
Source: bridgeComponentreview.exe, 00000005.00000002.2125421256.000000000070B000.00000004.00000020.00020000.00000000.sdmp, LhMoEdVbIY.exe, 0000001A.00000002.2347934703.0000000000672000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe API call chain: ExitProcess graph end node
Source: C:\containerprovider\bridgeComponentreview.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_007C866F
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C753D mov eax, dword ptr fs:[00000030h] 0_2_007C753D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007CB710 GetProcessHeap, 0_2_007CB710
Enables debug privileges
Source: C:\containerprovider\bridgeComponentreview.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BF063 SetUnhandledExceptionFilter, 0_2_007BF063
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BF22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_007BF22B
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007C866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_007C866F
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BEF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_007BEF05
Source: C:\containerprovider\bridgeComponentreview.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\containerprovider\WD8Tyzwe3aBcLS.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\containerprovider\HWCHX7UinH.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\containerprovider\bridgeComponentreview.exe "C:\containerprovider\bridgeComponentreview.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Process created: unknown unknown Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BED5B cpuid 0_2_007BED5B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_007BA63C
Queries the volume information (name, serial number etc) of a device
Source: C:\containerprovider\bridgeComponentreview.exe Queries volume information: C:\containerprovider\bridgeComponentreview.exe VolumeInformation Jump to behavior
Source: C:\containerprovider\bridgeComponentreview.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Queries volume information: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe Queries volume information: C:\Program Files (x86)\Microsoft\EdgeCore\LhMoEdVbIY.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007BD5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle, 0_2_007BD5D4
Source: C:\Users\user\Desktop\iwtYgAXvKB.exe Code function: 0_2_007AACF5 GetVersionExW, 0_2_007AACF5
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable UAC(promptonsecuredesktop)
Source: C:\containerprovider\bridgeComponentreview.exe Registry value created: PromptOnSecureDesktop 0 Jump to behavior
Disables UAC (registry)
Source: C:\containerprovider\bridgeComponentreview.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected DCRat
Source: Yara match File source: 24.2.LhMoEdVbIY.exe.2c8fd00.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.LhMoEdVbIY.exe.2c870fa.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.2351469122.0000000002CEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2352287301.0000000002401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2127728325.000000000294E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2127728325.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2351469122.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2143150573.0000000012481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: bridgeComponentreview.exe PID: 2504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LhMoEdVbIY.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LhMoEdVbIY.exe PID: 6768, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2143150573.000000001297B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe, type: DROPPED
Yara detected zgRAT
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected DCRat
Source: Yara match File source: 24.2.LhMoEdVbIY.exe.2c8fd00.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.LhMoEdVbIY.exe.2c870fa.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.2351469122.0000000002CEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2352287301.0000000002401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2127728325.000000000294E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2127728325.0000000002481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2351469122.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2143150573.0000000012481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: bridgeComponentreview.exe PID: 2504, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LhMoEdVbIY.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LhMoEdVbIY.exe PID: 6768, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2143150573.000000001297B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe, type: DROPPED
Yara detected zgRAT
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.bridgeComponentreview.exe.129b9715.11.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\LOU1YTO9ROLERK7.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\UYOTATHKKW9YY9G.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502157 Sample: iwtYgAXvKB.exe Startdate: 31/08/2024 Architecture: WINDOWS Score: 100 44 951499cm.nyashtech.top 2->44 50 Multi AV Scanner detection for domain / URL 2->50 52 Suricata IDS alerts for network traffic 2->52 54 Found malware configuration 2->54 56 16 other signatures 2->56 9 iwtYgAXvKB.exe 3 6 2->9         started        12 LhMoEdVbIY.exe 14 4 2->12         started        14 LhMoEdVbIY.exe 4 2->14         started        signatures3 process4 file5 36 C:\...\bridgeComponentreview.exe, PE32 9->36 dropped 38 C:\containerprovider\WD8Tyzwe3aBcLS.vbe, data 9->38 dropped 16 wscript.exe 1 9->16         started        40 C:\Users\user\AppData\...\UYOTATHKKW9YY9G.exe, PE32 12->40 dropped 42 C:\Users\user\AppData\...\LOU1YTO9ROLERK7.exe, PE32 14->42 dropped process6 signatures7 48 Windows Scripting host queries suspicious COM object (likely to drop second stage) 16->48 19 cmd.exe 1 16->19         started        process8 process9 21 bridgeComponentreview.exe 18 26 19->21         started        26 conhost.exe 19->26         started        dnsIp10 46 951499cm.nyashtech.top 80.211.144.156, 49704, 49711, 49715 ARUBA-ASNIT Italy 21->46 28 C:\Windows\Speech_OneCore\...\LhMoEdVbIY.exe, PE32 21->28 dropped 30 C:\Users\user\Links\sppsvc.exe, PE32 21->30 dropped 32 C:\Users\user\LhMoEdVbIY.exe, PE32 21->32 dropped 34 8 other malicious files 21->34 dropped 58 Antivirus detection for dropped file 21->58 60 Multi AV Scanner detection for dropped file 21->60 62 Machine Learning detection for dropped file 21->62 64 5 other signatures 21->64 file11 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
80.211.144.156
 951499cm.nyashtech.top Italy
31034 ARUBA-ASNIT true

Contacted Domains

Name IP Active
951499cm.nyashtech.top 80.211.144.156 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://951499cm.nyashtech.top/PollGeoDbwordpressTemporary/722944f89091ce5d9b1c5fbdfd00568555f67a8aa399d5400d05a2a7b07fcbcd263346663ea3568b true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://951499cm.nyashtech.top/sqlcentralUploads.php true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown