Windows Analysis Report 6BE4RDldhw.exe

Source: 6BE4RDldhw.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50052 version: TLS 1.2

Source:	Binary string: easinvoker.pdb source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E75908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

C2 URLs / IPs found in malware configuration

Networking

Source: Malware configuration extractor

URLs: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza

Contains functionality to check if a connection to the internet is available

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8E4B4 InternetCheckConnectionA,

0_2_02E8E4B4

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 108.170.55.202 108.170.55.202

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: SSASN2US SSASN2US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49737 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49728 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49767 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49744 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49773 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49752 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49721 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49760 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49729 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49786 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49799 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49780 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49793 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49806 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49812 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49819 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49825 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49832 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49838 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49850 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49858 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49870 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49876 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49862 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49845 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49889 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49883 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49896 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49901 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49912 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49908 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49925 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49931 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49936 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49919 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49943 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49949 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49962 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49956 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49969 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49975 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49982 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49987 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49998 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50007 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50012 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50019 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50024 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50031 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50033 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50042 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50046 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50052 -> 108.170.55.202:443

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in

Source: global traffic

DNS traffic detected: DNS query: taksonsdfg.co.in

Source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000002.2598433621.000000007FA30000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CD3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in
Source: 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000906000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2433890987.0000000000939000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/)r
Source: 6BE4RDldhw.exe, 00000000.00000003.1394882795.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/05
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/1r
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FABF000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FACD000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432121$
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza#
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza$
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza7
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza8
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzaaq
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzak
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzakb
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FABF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212P
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212a
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/4
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/9r6k
Source: 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Ar
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/H
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Ir
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Qr
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Qu
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Yr
Source: 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000906000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/ar
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-s
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345831810.0000000000919000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.000000000091A000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi$
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi)r
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi4
Source: 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza-bRk
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaCb
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaIb
Source: 6BE4RDldhw.exe, 00000000.00000003.2475345569.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaWb
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzakb
Source: 6BE4RDldhw.exe, 00000000.00000003.1690257877.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzaqb
Source: 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-R
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-RangesLas
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiU3
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgig3ok
Source: 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgim
Source: 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiqr
Source: 6BE4RDldhw.exe, 00000000.00000003.1394882795.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/iu
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/yr
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza0u
Source: 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_YjnxmyasmzaX
Source: 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi
Source: 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi$
Source: 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi1Content-LengthAllowWarningViaUpgradeTransfer-
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza0u
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi8
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi:
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiDASYC
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiP
Source: 6BE4RDldhw.exe, 00000000.00000002.2598024798.00000000206F3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2261026230.000000000092F000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961227445.0000000000928000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345256582.000000000093C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2433861488.00000000206F3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1475992472.0000000000922000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176965259.000000000093E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1394988770.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1520540319.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914704829.000000000093A000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475288001.000000000092F000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827529061.00000000206D1000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521010683.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FAC6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.veeble.org/contact/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50052 version: TLS 1.2

Yara detected Keylogger Generic

Source: Yara match

File source: Process Memory Space: 6BE4RDldhw.exe PID: 7796, type: MEMORYSTR

Contains functionality to call native functions

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E87D80 NtWriteVirtualMemory,	0_2_02E87D80
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DD6C RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02E8DD6C
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DBAC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02E8DBAC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DC88 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02E8DC88
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DC00 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02E8DC00
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88D6A GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02E88D6A
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88D6C GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02E88D6C

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8F7C4 InetIsOffline,CoInitialize,CoUninitialize,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_02E8F7C4

Detected potential crypto function

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E720C4

0_2_02E720C4

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E744DC appears 75 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E74500 appears 33 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E74860 appears 949 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E746D4 appears 244 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E889D8 appears 45 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E88954 appears 56 times

Sample file is different than original file name gathered from version info

Source: 6BE4RDldhw.exe	Binary or memory string: OriginalFilename vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2598433621.000000007FA30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2582071460.0000000002415000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe

Source: 6BE4RDldhw.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E77FDC GetDiskFreeSpaceA,

0_2_02E77FDC

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E86DD0 CoCreateInstance,

0_2_02E86DD0

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 6BE4RDldhw.exe	ReversingLabs: Detection: 65%
Source: 6BE4RDldhw.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

File read: C:\Users\user\Desktop\6BE4RDldhw.exe

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Contains functionality to dynamically determine API calls

Source: 6BE4RDldhw.exe

Static file information: File size 1483264 > 1048576

Source:	Binary string: easinvoker.pdb source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match

File source: 0.2.6BE4RDldhw.exe.2e70000.2.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E88954 LoadLibraryW,GetProcAddress,FreeLibrary,

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D2FC push 02E9D367h; ret	0_2_02E9D35F
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E763AE push 02E7640Bh; ret	0_2_02E76403
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E763B0 push 02E7640Bh; ret	0_2_02E76403
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9C374 push 02E9C56Ah; ret	0_2_02E9C562
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7332C push eax; ret	0_2_02E73368
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D0AC push 02E9D125h; ret	0_2_02E9D11D
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E83073 push 02E830C1h; ret	0_2_02E830B9
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E83074 push 02E830C1h; ret	0_2_02E830B9
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D1F8 push 02E9D288h; ret	0_2_02E9D280
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D144 push 02E9D1ECh; ret	0_2_02E9D1E4
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8F104 push ecx; mov dword ptr [esp], edx	0_2_02E8F109
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7678C push 02E767CEh; ret	0_2_02E767C6
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7678A push 02E767CEh; ret	0_2_02E767C6
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7D5A8 push 02E7D5D4h; ret	0_2_02E7D5CC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9C56C push 02E9C56Ah; ret	0_2_02E9C562
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7C574 push ecx; mov dword ptr [esp], edx	0_2_02E7C579
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8AADC push 02E8AB14h; ret	0_2_02E8AB0C
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88AD2 push 02E88B0Ch; ret	0_2_02E88B04
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88AD4 push 02E88B0Ch; ret	0_2_02E88B04
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7CBEF push 02E7CD7Ah; ret	0_2_02E7CD72
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7CBF4 push 02E7CD7Ah; ret	0_2_02E7CD72
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88874 push 02E888B6h; ret	0_2_02E888AE
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02EE4850 push eax; ret	0_2_02EE4920
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8694E push 02E869FBh; ret	0_2_02E869F3
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E86950 push 02E869FBh; ret	0_2_02E869F3
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E87914 push 02E87991h; ret	0_2_02E87989
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E85E84 push ecx; mov dword ptr [esp], edx	0_2_02E85E86
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E82F68 push 02E82FDEh; ret	0_2_02E82FD6

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon306.png

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E7676A IsIconic,

0_2_02E7676A

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8AB18 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02E8AB18

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

Allocates many large memory junks

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E70000 memory commit 480006144	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E71000 memory commit 480178176	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E9D000 memory commit 480002048	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E9E000 memory commit 480350208	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2EF4000 memory commit 481017856	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2FEE000 memory commit 480014336	Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E75908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8F740 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02E8F740

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Process queried: DebugPort

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E88954 LoadLibraryW,GetProcAddress,FreeLibrary,

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02E75ACC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: GetLocaleInfoA,	0_2_02E7A7CC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02E75BD8
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: GetLocaleInfoA,	0_2_02E7A818

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E79214 GetLocalTime,

0_2_02E79214

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E7B794 GetVersionExA,

0_2_02E7B794

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
108.170.55.202	taksonsdfg.co.in	United States		20454	SSASN2US	true

Contacted Domains

Name	IP	Active
taksonsdfg.co.in	108.170.55.202	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi	true	Avira URL Cloud: phishing	unknown
https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza	true	Avira URL Cloud: malware	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6BE4RDldhw.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi:	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi8	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaIb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/05	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiDASYC	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_YjnxmyasmzaX	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiqr	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/9r6k	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-RangesLas	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/H	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/234567876543212P	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432121$	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza0u	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzaaq	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/yr	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza0u	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/1r	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzakb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzaqb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/)r	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgim	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzak	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgig3ok	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza	Avira URL Cloud: Label: malware
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi$	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-s	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/Qu	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/Qr	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi1Content-LengthAllowWarningViaUpgradeTransfer-	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/Ir	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-R	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/Ar	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi)r	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaCb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza8	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza7	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/234567876543212a	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza-bRk	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzakb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/4	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi4	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiP	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/iu	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiU3	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/234567876543212	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi$	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaWb	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza$	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in	Avira URL Cloud: Label: phishing
Source: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza#	Avira URL Cloud: Label: malware

Found malware configuration

Source: 6BE4RDldhw.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza"]}

Multi AV Scanner detection for domain / URL

Source: taksonsdfg.co.in

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for submitted file

Source: 6BE4RDldhw.exe	ReversingLabs: Detection: 65%
Source: 6BE4RDldhw.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 6BE4RDldhw.exe

Joe Sandbox ML: detected

Source: 6BE4RDldhw.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50052 version: TLS 1.2

Source:	Binary string: easinvoker.pdb source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E75908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

C2 URLs / IPs found in malware configuration

Networking

Source: Malware configuration extractor

URLs: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza

Contains functionality to check if a connection to the internet is available

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8E4B4 InternetCheckConnectionA,

0_2_02E8E4B4

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 108.170.55.202 108.170.55.202

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: SSASN2US SSASN2US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49708 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49737 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49728 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49767 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49744 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49773 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49752 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49721 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49760 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49729 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49786 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49799 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49780 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49793 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49806 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49812 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49819 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49825 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49832 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49838 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49850 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49858 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49870 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49876 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49862 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49845 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49889 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49883 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49896 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49901 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49912 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49908 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49925 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49931 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49936 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49919 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49943 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49949 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49962 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49956 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49969 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49975 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49982 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49987 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49998 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50007 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50012 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50019 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50024 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50031 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50033 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50042 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50046 -> 108.170.55.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50052 -> 108.170.55.202:443

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /2345678765432123456789876543/243_Yjnxmyasmza HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in
Source: global traffic	HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: taksonsdfg.co.in

Source: global traffic

DNS traffic detected: DNS query: taksonsdfg.co.in

Source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000002.2598433621.000000007FA30000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CD3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in
Source: 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000906000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2433890987.0000000000939000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/)r
Source: 6BE4RDldhw.exe, 00000000.00000003.1394882795.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/05
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/1r
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FABF000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FACD000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432121$
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza#
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza$
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza7
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmza8
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzaaq
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzak
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/2345678765432123456789876543/243_Yjnxmyasmzakb
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FABF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212P
Source: 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FA8F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/234567876543212a
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/4
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/9r6k
Source: 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Ar
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/H
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Ir
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Qr
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Qu
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/Yr
Source: 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000906000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/ar
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-s
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345831810.0000000000919000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.000000000091A000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi
Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi$
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi)r
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi4
Source: 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.000000000090C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1690257877.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza-bRk
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaCb
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaIb
Source: 6BE4RDldhw.exe, 00000000.00000003.2475345569.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_YjnxmyasmzaWb
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzakb
Source: 6BE4RDldhw.exe, 00000000.00000003.1690257877.000000000090B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000909000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmzaqb
Source: 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-R
Source: 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1435332784.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.00000000008FC000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000901000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1648113930.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiLocationETagAuthentication-InfoAgeAccept-RangesLas
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiU3
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgig3ok
Source: 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgim
Source: 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/cgi-sys/suspendedpage.cgiqr
Source: 6BE4RDldhw.exe, 00000000.00000003.1394882795.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1519974580.0000000000903000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/iu
Source: 6BE4RDldhw.exe, 00000000.00000003.1961444779.0000000000905000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914742318.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827581814.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1870938682.0000000000903000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1917472858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in/yr
Source: 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_Yjnxmyasmza0u
Source: 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/2345678765432123456789876543/243_YjnxmyasmzaX
Source: 6BE4RDldhw.exe, 00000000.00000003.2047547102.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2004240497.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1738626305.00000000008CB000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000091C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi
Source: 6BE4RDldhw.exe, 00000000.00000003.2129633802.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi$
Source: 6BE4RDldhw.exe, 00000000.00000003.1519974580.00000000008CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi1Content-LengthAllowWarningViaUpgradeTransfer-
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi43/243_Yjnxmyasmza0u
Source: 6BE4RDldhw.exe, 00000000.00000003.1914742318.00000000008CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi8
Source: 6BE4RDldhw.exe, 00000000.00000003.1648113930.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgi:
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2388478976.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2303973460.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiDASYC
Source: 6BE4RDldhw.exe, 00000000.00000003.2434006872.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475345569.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://taksonsdfg.co.in:443/cgi-sys/suspendedpage.cgiP
Source: 6BE4RDldhw.exe, 00000000.00000002.2598024798.00000000206F3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2047547102.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2261026230.000000000092F000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1961227445.0000000000928000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2089947021.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345256582.000000000093C000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2433861488.00000000206F3000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1475992472.0000000000922000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176965259.000000000093E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1394988770.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1520540319.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1914704829.000000000093A000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2475288001.000000000092F000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521127885.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1827529061.00000000206D1000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008BA000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2521010683.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2345346508.000000000092B000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2597281272.000000001FAC6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.veeble.org/contact/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.170.55.202:443 -> 192.168.2.7:50052 version: TLS 1.2

Yara detected Keylogger Generic

Source: Yara match

File source: Process Memory Space: 6BE4RDldhw.exe PID: 7796, type: MEMORYSTR

Contains functionality to call native functions

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E87D80 NtWriteVirtualMemory,	0_2_02E87D80
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DD6C RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02E8DD6C
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DBAC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02E8DBAC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DC88 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02E8DC88
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8DC00 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02E8DC00
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88D6A GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02E88D6A
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88D6C GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02E88D6C

Contains functionality to launch a process as a different user

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8F7C4 InetIsOffline,CoInitialize,CoUninitialize,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_02E8F7C4

Detected potential crypto function

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E720C4

0_2_02E720C4

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E744DC appears 75 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E74500 appears 33 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E74860 appears 949 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E746D4 appears 244 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E889D8 appears 45 times
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: String function: 02E88954 appears 56 times

Sample file is different than original file name gathered from version info

Source: 6BE4RDldhw.exe	Binary or memory string: OriginalFilename vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2598433621.000000007FA30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC5F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000002.2582071460.0000000002415000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs 6BE4RDldhw.exe
Source: 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs 6BE4RDldhw.exe

Source: 6BE4RDldhw.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E77FDC GetDiskFreeSpaceA,

0_2_02E77FDC

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E86DD0 CoCreateInstance,

0_2_02E86DD0

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 6BE4RDldhw.exe	ReversingLabs: Detection: 65%
Source: 6BE4RDldhw.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

File read: C:\Users\user\Desktop\6BE4RDldhw.exe

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Contains functionality to dynamically determine API calls

Source: 6BE4RDldhw.exe

Static file information: File size 1483264 > 1048576

Source:	Binary string: easinvoker.pdb source: 6BE4RDldhw.exe, 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: 6BE4RDldhw.exe, 00000000.00000003.1333153403.000000007FC10000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2584298983.0000000002E9E000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333431137.0000000002CB6000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2582071460.00000000023C6000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.1333810883.000000007F8A0000.00000004.00001000.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000002.2583380707.0000000002CAB000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match

File source: 0.2.6BE4RDldhw.exe.2e70000.2.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E88954 LoadLibraryW,GetProcAddress,FreeLibrary,

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D2FC push 02E9D367h; ret	0_2_02E9D35F
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E763AE push 02E7640Bh; ret	0_2_02E76403
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E763B0 push 02E7640Bh; ret	0_2_02E76403
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9C374 push 02E9C56Ah; ret	0_2_02E9C562
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7332C push eax; ret	0_2_02E73368
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D0AC push 02E9D125h; ret	0_2_02E9D11D
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E83073 push 02E830C1h; ret	0_2_02E830B9
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E83074 push 02E830C1h; ret	0_2_02E830B9
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D1F8 push 02E9D288h; ret	0_2_02E9D280
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9D144 push 02E9D1ECh; ret	0_2_02E9D1E4
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8F104 push ecx; mov dword ptr [esp], edx	0_2_02E8F109
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7678C push 02E767CEh; ret	0_2_02E767C6
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7678A push 02E767CEh; ret	0_2_02E767C6
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7D5A8 push 02E7D5D4h; ret	0_2_02E7D5CC
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E9C56C push 02E9C56Ah; ret	0_2_02E9C562
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7C574 push ecx; mov dword ptr [esp], edx	0_2_02E7C579
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8AADC push 02E8AB14h; ret	0_2_02E8AB0C
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88AD2 push 02E88B0Ch; ret	0_2_02E88B04
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88AD4 push 02E88B0Ch; ret	0_2_02E88B04
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7CBEF push 02E7CD7Ah; ret	0_2_02E7CD72
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E7CBF4 push 02E7CD7Ah; ret	0_2_02E7CD72
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E88874 push 02E888B6h; ret	0_2_02E888AE
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02EE4850 push eax; ret	0_2_02EE4920
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E8694E push 02E869FBh; ret	0_2_02E869F3
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E86950 push 02E869FBh; ret	0_2_02E869F3
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E87914 push 02E87991h; ret	0_2_02E87989
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E85E84 push ecx; mov dword ptr [esp], edx	0_2_02E85E86
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Code function: 0_2_02E82F68 push 02E82FDEh; ret	0_2_02E82FD6

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon306.png

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E7676A IsIconic,

0_2_02E7676A

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

0_2_02E8AB18

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

Allocates many large memory junks

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E70000 memory commit 480006144	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E71000 memory commit 480178176	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E9D000 memory commit 480002048	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2E9E000 memory commit 480350208	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2EF4000 memory commit 481017856	Jump to behavior
Source: C:\Users\user\Desktop\6BE4RDldhw.exe	Memory allocated: 2FEE000 memory commit 480014336	Jump to behavior

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E75908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: 6BE4RDldhw.exe, 00000000.00000002.2580778228.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 6BE4RDldhw.exe, 00000000.00000003.2176461994.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E8F740 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02E8F740

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Process queried: DebugPort

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\6BE4RDldhw.exe

Code function: 0_2_02E88954 LoadLibraryW,GetProcAddress,FreeLibrary,